SMTP/TLS decryption debugging

[DionStempfley]

I'm fully expecting that I have made a super simple error here, but I'm not getting the results I expected when setting up SMTP/TLS decryption.  We are running Netwitness 11.6.  I uploaded the private keys for our mail servers and set the /decoders/parsers/config/parsers.options to include smtpsPorts, But I don't see the tls.premaster meta or any of the other meta that I expected.  I'm not seeing any useful information on debugging my setup to determine what is going on.  Can anyone provide some insight?

I setup everything according to the document https://community.rsa.com/t5/rsa-netwitness-platform-online/decrypt-incoming-packets/ta-p/592185.  

My parsers.options for the decoder is set to:

Entropy="log2=true",HTTP="decompress=81",HTTP2="headers=true",HTTPS="smtpsPorts=25 cert.sha1=true cert.sha256=true ja3=true ja3s=true"

Any insight would be appreciated,

/Dion

[JoshRandall]

My initial reaction is that your parsers.options syntax is not correct and that each argument needs to be space-delimited instead of comma-delimited:

Entropy="log2=true" HTTP="decompress=81" HTTP2="headers=true" HTTPS="smtpsPorts=25 cert.sha1=true cert.sha256=true ja3=true ja3s=true"

But if that's been working for you in the past, then some additional things to check...

1. when you uploaded your private keys, what was the response from the Decoder?
2. is your SMTPS cipher suite in the table of supported/decryptable ciphers?
3. did you reload parsers after modifying the parsers.options?

Also - this article might be a bit easier/better to use as a guide. It's screenshots are not broken.

https://community.rsa.com/t5/rsa-netwitness-platform-online/decoder-decrypt-incoming-packets/ta-p/572035 

[DionStempfley]

Thanks for the reply.  I don't doubt that the format of the command is wrong.  I added the commas in the HTTPS section sans any real examples to work from, I guessed. Unfortunately with or without the commas and even a hybrid fashion with no commas in the HTTPS command but commas separating the other directives I don't get any response other than ok.  Loading the keys, I didn't get an error either.

I guess my frustration is how friendly Netwitness is at not yelling at me to tell me something isn't right. I'll keep digging.

/D