When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text.

That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are already encrypted.

The only way to read these packets in a LAN environment is intercepting the POST request before it goes to the router? Only after that the packet will be encrypted? Or the packet is encrypted just right before the request leaves the client device machine?

1 Answer 1


SSL/TLS encryption is done end-to-end, meaning only each end can successfully decrypt the session. The point of it being that Wireshark, or other network capture/sniffing tools, cannot eavesdrop on the data contained.

In a LAN or corporate environment, SSL interception looks like this:

  1. Client workstations tries to go to https://somesite.
  2. Inspection appliance sees this, and on-the-fly replaces https://somesite's certificate with a corporate certificate.
  3. Each workstation on the network trusts the corporate certificate, so no error is displayed.
  4. The client then encrypts the request with the corporate certificate, allowing the internal appliance to decrypt and inspect the traffic.
  5. If all is well, the inspection appliance will re-encrypt the data using https://somesite's certificate, and then pass it on to the destination, and replies back to the workstation.

In such a way, the endpoints are really https://somesite and the inspection appliance. Another session happens between the workstation and the inspection appliance which is essentially relayed to its final destination.

Essentially, the inspection appliance in this case is performing what is known as a "man-in-the-middle" attack, except ostensibly with permission to do so.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .