Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

tshark how to enable nas-5gs EEA0 decrypt

tshark how to enable nas-5gs EEA0 decrypt, I have been trying all options i can think of to figure out the correct KEY, one such example below tshark -r 1UE.pcap -o nas_5gs.mm.eea0.null_decipher:true -Y "ngap" -T json >packets.json

tshark: -o flag "nas_5gs.mm.eea0.null_decipher:true" specifies unknown preference

Like wise tried many others

  1. -o EEA0:TRUE
  2. -o nas_5gs.mm.5g_ea0:TRUE