# Effect of TLS traffic on inspection **URL:** \ **Category:** Zeek\ **Created:** [March 12, 2020, 7:46am UTC](https://community.zeek.org/t/effect-of-tls-traffic-on-inspection/6048 "2020-03-12T07:46:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Abhishek\_Singh](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@Abhishek\_Singh](https://community.zeek.org/u/Abhishek_Singh)\ **Post date:** [March 12, 2020, 7:46am UTC](https://community.zeek.org/t/effect-of-tls-traffic-on-inspection/6048/1 "2020-03-12T07:46:31Z")
Experts, I was wondering what effect the rise in TLS traffic has on IDS applications like Zeek. Since Zeek (or other IDS applications like Snort and Suricata) will not be able to inspect the content of majority of the connections as they will be encrypted, will this make IDS less useful going forward? If yes, what are the ways being considered to overcome this challenge? Is becoming an inline device with man in the middle capabilities an option? Or is TLS offloading to a different device that can send us a copy of the decrypted traffic for inspection the preferred option? Please pardon me if these are naive questions. I am new to the world of IDS and am trying to learn more about them. - Abhi ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [March 12, 2020, 11:05am UTC](https://community.zeek.org/t/effect-of-tls-traffic-on-inspection/6048/2 "2020-03-12T11:05:45Z")
If you can decrypt, do that. If you can sniff decrypted traffic and encrypted, then you’d get all the decrypted traffic plus all the super useful ja3 and ja3s fingerprints. There is a ton of value in mapping what TLS cipher suites are used where in your environment. If you have enough money decrypt and sniff both decrypted and encrypted, I’d do it. Cheers, JB > **From:** [toabhisheksingh@gmail.com](mailto:toabhisheksingh@gmail.com) > **Sent:** March 12, 2020 3:48 AM > **To:** [Zeek@zeek.org](mailto:Zeek@zeek.org) > **Subject:** [Zeek] Effect of TLS traffic on inspection > > | > > - | Experts, I was wondering what effect the rise in TLS traffic has on IDS applications like Zeek. Since Zeek (or other IDS applications like Snort and Suricata) will not be able to inspect the content of majority of the connections as they will be encrypted, will this make IDS less useful going forward? If yes, what are the ways being considered to overcome this challenge? Is becoming an inline device with man in the middle capabilities an option? Or is TLS offloading to a different device that can send us a copy of the decrypted traffic for inspection the preferred option? Please pardon me if these are naive questions. I am new to the world of IDS and am trying to learn more about them. - Abhi ---
**Author:** ![Richard\_Bejtlich](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/richard_bejtlich/32/597_2.png) [@Richard\_Bejtlich](https://community.zeek.org/u/Richard_Bejtlich)\ **Post date:** [March 12, 2020, 12:27pm UTC](https://community.zeek.org/t/effect-of-tls-traffic-on-inspection/6048/3 "2020-03-12T12:27:32Z")
This is NOT intended as an advertisement, but if you want to check it out, we’ve been blogging about how to use Zeek vs encrypted traffic on the Corelight blog. [https://corelight.blog/tag/encryption/](https://corelight.blog/tag/encryption/) Sincerely, Richard ---
**Author:** ![Kevin\_Ross](https://avatars.discourse-cdn.com/v4/letter/k/9de053/32.png) [@Kevin\_Ross](https://community.zeek.org/u/Kevin_Ross)\ **Post date:** [March 12, 2020, 4:01pm UTC](https://community.zeek.org/t/effect-of-tls-traffic-on-inspection/6048/4 "2020-03-12T16:01:34Z")
These are helpful talks on the subject on using zeek style metadata JA3 asking for a friend (2019): [https://www.youtube.com/watch?v=HrP6Ep3xgQM&t=684s](https://www.youtube.com/watch?v=HrP6Ep3xgQM&t=684s) Network forensics in an encrypted world (2017 but covers a lot of indicators you can hunt on) [https://www.youtube.com/watch?v=APHlvFaUEKE&t=1930s](https://www.youtube.com/watch?v=APHlvFaUEKE&t=1930s) Encrypted things: Network detection and response in an encrypted world [https://www.youtube.com/watch?v=HPvIGP2mgbI&t=2667s](https://www.youtube.com/watch?v=HPvIGP2mgbI&t=2667s) Security Onion Conference 2019: Finding traffic anomalies using SSL certificates [https://www.youtube.com/watch?v=-WD9BWlENwc&t=762s](https://www.youtube.com/watch?v=-WD9BWlENwc&t=762s) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/effect-of-tls-traffic-on-inspection/6048/5 "2022-05-06T15:47:08Z")