Displays details about live traffic from the SSL flows that matches a particular attribute in the archived log file. Viewing archived log details on SSL flows can help you to identify previous trends or patterns in SSL interception traffic.
For details about how to display the archived log file details, see the "Managing the Connection Event Logs of the SSL Flows" section in the "Troubleshooting" appendix of the Network Security User Guide.
Syntax
show session-logger ssl archive matching <value>Parameters
<value>
<value>A particular date and time, domain name, client IP address and port, server IP address and port, cipher suite, SNI sent by the client or server, or action that was taken on the SSL flow.
Output fields
The following table describes the output fields for the show session-log ssl archive matching command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Date | Date that the connection event is logged. |
Time | Time that the connection event is logged. |
c_ip | IP address of the client. |
c_port | Port number of the client. |
s_ip | IP address of the server. |
s_port | Port number of the server. |
cs_bytes | Client-side bytes transferred during the connection and logged. |
rs_bytes | Server-side bytes transferred during the connection and logged. |
cs_tls_ version | TLS version required for client-side connections. |
rs_tls_ version | TLS version required for server-side connections. |
cs_cipher_ suite | Cipher suite associated with client-side connections. |
rs_cipher_ suite | Cipher suite associated with server-side connections. |
rs_cert_ common_ name | Common name of the server-side certificate. |
action | Whether the connection was decrypted, whitelisted, or blocked due to an attack seen in decrypted content. |
s_site_name | Server name identification (SNI) sent by the client or server. |
error | Types of error codes for connection events:
|
Example
The following example displays partial output about SSL flow traffic that matched a domain name in the archived log file.
hostname # show session-logger ssl archive matching microsoft.com ........ Oct 12 18:13:38 192.168.69.157 52818 40.79.85.125 443 cs_bytes:N/A cs_tls_version:TLSv1.2 rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA rs_cert_common_name:*.big.telemetry.microsoft.com action:(ssl-1,whitelisted-0,block-0) s_site_name:watson.telemetry.microsoft.com error:N/A Oct 12 18:13:39 192.168.69.157 52819 40.79.85.125 443 cs_bytes:N/A cs_tls_version:TLSv1.2 rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA rs_cert_common_name:*.big.telemetry.microsoft.com action:(ssl-1,whitelisted-0,block-0) s_site_name:watson.telemetry.microsoft.com error:N/A Oct 12 18:15:45 192.168.69.157 52836 64.4.54.253 443 cs_bytes:N/A cs_tls_version:TLSv1.2 rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA rs_cert_common_name:settings-win.data.microsoft.com action:(ssl-1,whitelisted-0,block-0) s_site_name:settings-win.data.microsoft.com error:N/A Oct 12 18:15:46 192.168.69.157 52837 64.4.54.253 443 cs_bytes:N/A cs_tls_version:TLSv1.2 rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA rs_cert_common_name:settings-win.data.microsoft.com action:(ssl-1,whitelisted-0,block-0) s_site_name:settings-win.data.microsoft.com error:N/A Oct 12 18:15:46 192.168.69.157 52838 64.4.54.253 443 cs_bytes:N/A cs_tls_version:TLSv1.2 rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA rs_cert_common_name:settings-win.data.microsoft.com action:(ssl-1,whitelisted-0,block-0) s_site_name:settings-win.data.microsoft.com error:N/A ........
User role
Administrator
Command mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 8.2.1.