How can I watch LDAP traffic on port 389?

Question

I use the Charles Web Debugging proxy to view traffic on ports 80/443 for HTTP and HTTPS requests. On Mac OS X, what program can I use to view traffic on port 389/636 for ldap:// and ldaps:// ? I am interested in seeing the actual requests / responses, partially seeing how safe they are and what the differences are, and partially just because I'm curious about what the requests look like.

Answer 1

As noted, Wireshark or tcpdump. You will not be able to judge the security of requests and responses because you must view unsecured connection traffic. If it were encrypted, you would not be available to view traffic that is not encrypted. SSL or StartTLS (as an advanced operation) should be used to protect LDAP traffic. For more information on the LDAP message envelope, see RFC4511 .

Answer 2

You can use Mac OS X built into the tcpdump command, I believe you need a call that looks like sudo tcpdump -i en0 port 389,636 , although there are other flags on the man page to print the actual request data (try man tcpdump )

Answer 3

You can use Wireshark .

Answer 4

This is also work:

tcpdump -n not port ssh and port 389 , not broadcast, not multicast