TLS Visibility
Telovix can observe application plaintext for supported TLS workloads, including TLS 1.3, without placing a proxy or gateway in the traffic path. The encrypted network connection remains encrypted; Telovix displays only plaintext the monitored process made available during normal send or receive processing.
TLS visibility supports API Security, 5G SBI analysis, telecom security findings, and on-demand PCAPNG capture.
Where to use TLS evidence
| Console area | Use it to |
|---|---|
| Detect > API Security | Inspect HTTPS methods, routes, callers, destinations, requests, responses, and findings. |
| Telco > Sessions > 5G Core | Review SBI activity and network-function relationships. |
| Telco > Threats | Review plaintext, encrypted, and coverage-gap findings. |
| Telco > Assurance > Packet Capture | Create a bounded PCAPNG with protocol and observed TLS plaintext evidence. |
| Monitor > Investigate | Search exact TLS and API observations with process and sensor context. |
Supported application TLS stacks
Telovix supports common applications using:
- OpenSSL;
- GnuTLS;
- Go
crypto/tls; - BoringSSL.
Availability depends on the application build, architecture, symbols, runtime packaging, and whether the sensor can identify a supported TLS path for that process. Check the displayed coverage state rather than assuming every process using HTTPS is inspectable.
Coverage states
| State | Meaning |
|---|---|
| Plaintext observed | Application plaintext was observed for the selected process and period. |
| TLS observed | Encrypted TLS activity was identified, but no plaintext evidence is available for the selected record. |
| Not observed | No matching TLS evidence was seen in the selected period. |
| Unsupported | The application TLS stack or traffic path is not currently supported. |
| Partial | Only part of the expected request, response, or stream evidence is available. |
| Lost | Capture or delivery loss affected the evidence. |
| Unavailable | The Console cannot currently retrieve or evaluate the evidence. |
An encrypted or unsupported state is a visibility limitation, not proof of insecure TLS. A plaintext observation on an interface expected to use TLS may require investigation.
API request and response evidence
Open an endpoint or finding in API Security and use the Request, Response, and Observations tabs.
The panel shows the available method, route, content type, request or response body, truncation, pairing, capture source, and inspection outcome. Request and response bodies are visible only to Admin and Operator roles.
Normal API observation keeps body evidence bounded. If the required content is absent or truncated, enable Extended Capture for the specific sensor and investigation window. Extended Capture is not fleet-wide and can increase resource use and evidence volume.
5G SBI evidence
For supported HTTP/2 SBI traffic, Telovix can connect the request to the network function, process, workload, service, destination, operation, status, and available body evidence.
If capture starts after an HTTP/2 connection is already established, some headers may be missing even when plaintext content is visible. Telovix does not invent the method or path. Validate with a new request on a new connection during an approved test. A connection shown in topology alone is not proof that its HTTP content was decoded.
Use the evidence to investigate:
- unexpected NF consumers or producers;
- unapproved or shadow SBI operations;
- authentication and authorization failures;
- abnormal error or latency behavior;
- sensitive request and response content;
- TLS visibility gaps on an SBI relationship.
Do not treat a missing body as an empty body. Review the inspection and coverage state.
Export decrypted evidence to PCAPNG
Use Telco > Assurance > Packet Capture to start a bounded capture for one sensor. Diagnostic and Deep profiles can include observed TLS plaintext. After finalization, download the PCAPNG and open it in Wireshark.
TLS plaintext is exported as Wireshark Upper PDU evidence. A zero decrypted-record count means no supported TLS plaintext was observed during that capture; it does not mean all encrypted packets were unsuccessfully decrypted.
See Telecom Capture for profiles, durations, target coverage, download states, and Wireshark guidance.
Containers and Kubernetes
TLS visibility follows the selected process whether it runs directly on a host, in a standalone container, or in a Kubernetes pod. API Security adds the available host, container, namespace, workload, service, and cluster context.
If the same application image behaves differently between nodes, compare:
- image and application build;
- CPU architecture;
- sensor flavor and version;
- TLS coverage state;
- selected sensor and time range;
- container and workload identity.
Validation workflow
- Select one sensor and application.
- Generate a known HTTPS or SBI request.
- Open API Security and find the endpoint.
- Confirm process, caller, destination, method, and response status.
- Open Request, Response, and Visibility.
- If needed, start a short Diagnostic capture on the same sensor and repeat the request.
- Download the PCAPNG and confirm the Upper PDU record in Wireshark.
Use a controlled request so the expected route and content are known before diagnosing coverage.
Troubleshooting
| Symptom | Check |
|---|---|
| HTTPS endpoint appears without body evidence | Check role, body inspection state, truncation, pairing, and TLS coverage. |
| One node has plaintext evidence and another does not | Compare application build, architecture, runtime packaging, sensor version, and coverage state. |
| Go application is unsupported | Confirm the deployed binary and symbols are compatible with the reported TLS visibility state. |
| Container traffic is missing | Confirm the sensor is on the node running the workload and that the selected scope matches its container or pod. |
| PCAPNG has no decrypted records | Generate TLS traffic during the active capture and verify the selected profile includes TLS evidence. |
| Wireshark does not decode the application protocol | Inspect the Upper PDU record and use Decode As when the protocol uses a non-standard port. |
| SBI relationship is unresolved | Open API Security Summary and Observations tabs and verify caller, authority, service, and selected cluster scope. |