Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

TLS Decryption - when does Wireshark reload the master secret log?

I am trying to decrypt TLS connections using Wireshark which works in general, but it seems like Wireshark does not detect and reload the configured in TLS options as (Pre)-Master-Secret log filename.

I would expect that at least every time I execute Follow-> TLS stream in Wireshark it should check if the file has been changed an reload the contained keys. Because how is Wireshark supposed to decode a session while capturing is in progress?

At the moment the only reliable way I have found is to stop capturing, save the data to a PCAP file and then reopen the saved PCAP file.