Bug ID 880009: Tcpdump does not export the TLS1.3 early secret

Last Modified: Dec 13, 2023

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3

Fixed In:
16.0.0

Opened: Feb 11, 2020

Severity: 3-Major

Symptoms

Users running tcpdump with the 'ssl:v' flag to obtain the early traffic secret are given the early master secret instead.

Impact

Users cannot decrypt TLS1.3 early data packets.

Conditions

Run tcpdump with the 'ssl:v' flag.

Workaround

None.

Fix Information

Tcpdump will now output the early traffic secret with the 'ssl' flag. The 'ssl:v' flag will continue to be used for outputting the early master secret.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips