Hi, I know how to use wireshark inorder to decode an encrypted ssl\tls pcap when providing the key. I can't save the decrypted pcap without it depending on the key. Is there a way to save the decrypted pcap in a way that it won't depend on the key? Thanks
You can also save the decrypted packets starting from Wireshark 2.0 (if I remember correctly) by clicking on File -> Export PDUs to file -> OSI layer 7.
Wireshark won't save the decrypted data, but you can export the session keys which are specific to the traffic in your capture file. After doing the decryption with the private key, go to file -> Export TLS Session Keys. Save the keys to a file. When you want to view the decrypted traffic again without the private key, point to the session keys file in the TLS protocol preferences under "(Pre)-Master-Secret log filename".
You can also add the keys to the pcap-ng file so that you do not have to point to a separate file by using editcap --inject-secrets tls,<file-with-exported-keys> <original.pcap> <new.pcap>
Asked: 2019-10-15 12:32:14 +0000
Seen: 10,592 times
Last updated: Oct 15 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
