I wish to understand what is happening under the hood in wireshark, how is it implemented on a more basic level. Can it be used with tshark? How hard would it be to combine it with other smaller libraries or implement my own script?
Yes it can be used with tshark. Either set the path to the keylogfile in a profile and use that profile with tshark (-C option) or pass the path as a configuration option with -o tls.keylog_file:path\to\keylog.
The secrets from the file are associated with the TLS handshakes to generate the keys required for decryption.
The code is built for use by dissectors within the Wireshark framework, it might be some effort to extract it for use elsewhere.
Asked: 2019-07-31 22:11:34 +0000
Seen: 189 times
Last updated: Aug 01 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
