tshark display decrypted Quic Hex without using -x
Nice to meet you
tshark ( and wireshark also) sometimes does not parse Quic protocol correctly.
Please see the picture below, we can see that wireshark only display "Handshake Protocol: Encrypted Handshake Message (fragment)" and no more information inside it. in this case, i capture before quic packet arrived so does not miss any packet.
The tshark / wireshark version is : 3.6.0 (v3.6.0-0-g3a34e44d02c9) (windows 10 64bit)
The question is :
How to extract Decrypted QUIC hex ( or acsii ) data on command line from tshark without using -x.
Sure, -x argument is the esiest way but -this option can not go with -T fields and -e .
Hope i can have your advice .Many thank for your help
add a comment