Why I am not seeing any SSL/TLS packets when open a pcap using my MAC? When opened from another windows or MAC I do see these packets without any issue.

asked 2018-03-08 00:49:42 +0000

Shishir
1 ●1

updated 2018-03-08 00:50:18 +0000

Who I am not seeing any SSL/TLS packets when open a cap using my MAC? When opened from another windows or MAC I do see these packets without any issue.

Verified with multiple machines, and seem issue with only my machine. My version is latest one available for MAC, 2.4.5

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-03-10 18:44:20 +0000

sindy
6209 ●5 ●66 ●55

I would assume that you have disabled some dissector between the ethernet and TLS layer when analysing something on that Mac and then closed Wireshark. Wireshark automatically saves the configuration into your profile.

So verify that eth (or, eventually, wlan if you capture on wireless interface), ip, tcp, and ssl dissectors are all enabled on that Mac. Also vlan can theoretically be in the chain.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2018-03-08 00:49:42 +0000

Seen: 222 times

Last updated: Mar 10 '18

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

Why I am not seeing any SSL/TLS packets when open a pcap using my MAC? When opened from another windows or MAC I do see these packets without any issue. edit

1 Answer