Revision history [back]

-w testcase_decrypted.pcap

Wireshark does not save decrypted capture files:
TLS\SSL pcap with key - save decrypted output to pcap file without the attach key

Notes:

• the syntax for setting a uat preference is in the -o section of the Wireshark man page. tshark man page needs an update.
• using single quotes ' can make the command line easier to read:
  TLS decryption with Tshark and RSA keys

tshark -r your.pcap '-ouat:rsa_keys:"/path/to/key.file",""'

• sample capture and key attached to 18273: ieee80211: Wireshark gives wrong A-MSDU subframe length