How can I watch LDAP traffic on port 389?

debugging proxy ldap packet-sniffers sniffing
cwd picture cwd · Nov 7, 2011 · Viewed 20.9k times · Source

I use Charles Web Debugging Proxy to watch traffic on ports 80 / 443 for HTTP and HTTPS requests. With Mac OS X, what program can I use to watch traffic on port 389 / 636 for ldap:// and ldaps://? I'm interested in seeing the actual requests / responses, partially to see how secure they are and what the differences are, and partially just because I'm curious as to what the requests look like.

Answer

Terry Gardner picture Terry Gardner · Nov 7, 2011

As noted, Wireshark or tcpdump. You will not be able to judge the security of the requests and responses, because you must view the unsecured connection traffic. If it were encrypted, you would not be available to view the traffic unencrypted. SSL or StartTLS (as an extended operation) should be used to secure LDAP traffic. For more information about the LDAP message envelope, see RFC4511.

Related questions

How do I see the raw HTTP request that the HttpWebRequest class sends?

I know you are all going to answer "use a debugging proxy server like Fiddler" but it's not that simple. Here's my situation: I have some code that runs on a server, in an ASP.NET page code-behind (aspx.cs), …

Read More
Charles web debugging proxy not detecting vpn connection

I have a VPN connection on which I'm testing some websites using Charles Web Debugging Proxy, but Charles doesn't seem to detect my VPN connection because it doesn't detect the websites that I'm running on the VPN network. Any help …

Read More
How to watch network traffic? A la packet sniffing or web debugging proxy?

So when I am debugging my web applications and such, I've used the Charles web proxy and debugger and love it. It's so nice to see what's being sent and received via port 80 and 443. I can see all the resources …

Read More