dnscap
dnscap copied to clipboard
Feature proposal: DoT logging using SSLKEYLOGFILE
Modern versions of SSL libraries support TLS session key logging via environment variable SSLKEYLOGFILE
. This opens possibility to decipher TLS traffic in dnscap and to log DNS traffic from "inside" of the TLS channel.
Roughly:
- Set
SSLKEYLOGFILE
in DNS server environment to a file or pipe - dnscap reads session keys from given file or pipe
- TLS traffic is decrypted using given session key
- DNS packets are saved into output as usual.
Wireshark already implements this so there is possibility get inspiration in its code base.