Editcap not found on mac osx

edit

I have Wireshark 3.2.5 on my mac. Where do I find that package?

In the .dmg that you downloaded to install Wireshark 3.2.5. You may have to download it again; you won't need to drag-install Wireshark again, but you will need to double-click the "Add Wireshark to the system path" package to install it.

Oh I see. Thanks a lot. I am using the sample capture file from Wireshark, found here: https://wiki.wireshark.org/DTLS. The key log file provided (snakeoil-rsa.key) is an unsupported private key file, and the decryption will not work. Do I change this to a nss format? And if so, how would I do that?

Are you looking specifically for DTLS test files or would regular TLS be ok?

I am looking only to embed the keys into the pcap file (specifically this DTLS test file) to create one single pcapng file. Right now, the capture and the key come separately.

Since Guy was able to help with installing Editcap, moving the keys discussion back to the original question "How do I add keys (that I already have) to a packet capture?"