Lekensteyn's profile - activity

@cmaynard Your tool sends the query to the server. I'd not recommend that tool and suggest the Wireshark OUI tool instea

A fix has been implemented and deployed, thanks for raising this!

I'll restore support for other formats. It was removed because these were not documented as valid options and the old pa

You should not try to access the decrypted data via a field, but ensure that dissectors call each other. Register your

I don't see an attached flow. In any case, note that QUIC is an in-development protocol and subject to change. If you kn

This does not look like TLS traffic to me.

Hi, consider providing the original capture file (note that it will obviously be public, so hopefully it does not have s

In TLS 1.2 and before, the PSK can be used with PSK cipher suites such as TLS_PSK_WITH_AES_128_CCM to decrypt sessions i

The result of ProtoField.new(...) should be added to the fields property of a Proto instance. This allows them to be reg

From my reply at https://www.wireshark.org/lists/wireshark-users/202001/msg00000.html: In your screenshot, the visible

(This question was cross-posted at https://www.wireshark.org/lists/wireshark-users/201912/msg00009.html)

(This question was cross-posted at https://www.wireshark.org/lists/wireshark-users/201912/msg00009.html)

(This question was cross-posted at https://www.wireshark.org/lists/wireshark-users/201912/msg00009.html)

simulate packets of TCP/IP protocols I hope you don't mind my asking this, but I've been looking for different types of

The TLS key log file (not to be confused with debug log file) can indeed not be used with RSA key files, it can only acc

There are several possible reasons why you do not always see decryped HTTP/2 traffic: Your capture started while the T

There are several possible reasons why you do not always see decryped HTTP/2 traffic: Your capture started while the T

Wireshark supports TLS 1.3 since Wireshark 2.6.0. It of course supports the final RFC 8446 version, but currently suppor

Wireshark supports TLS 1.3 since Wireshark 2.6.0. It of course supports the final RFC 8446 version, but currently suppor

The reporter has opened a bug report at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15910, CoAP over WebSockets

DNS-over-TLS (DoT) is different from DNS-over-HTTPS (DoH). The former defaults to TCP port 853 where the latter runs ove

You can manually build from source using the latest tarball, the Debian packaging scripts are included. Grab the latest

If you open the packet capture in Wireshark, you will find it in the packet details:

TLS negotiates the TLS version during the handshake. The client reports its minimum version through the tls.record.versi

TLS negotiates the TLS version during the handshake. The client reports its minimum version through the tls.record.versi

When implementations fail during the TLS handshake, they typically do either: Forcefully the TCP connection. This can

When implementations fail during the TLS handshake, they typically do either: Forcefully the TCP connection. This can

Wireshark has reasonable support (dissection and decryption) for the QUIC version that is in development by the IETF wor

Wireshark has reasonable support (dissection and decryption) for the QUIC version that is in development by the IETF wor

Wireshark has reasonable support (dissection and decryption) for the QUIC version that is in development by the IETF wor

Building libsslkeylog.so requires OpenSSL development headers which you can install with yum install openssl-devel as ro

As Graham said, your session is using an ephemeral Diffie-Hellman (DH) cipher suite: ssl_set_cipher found CIPHER 0xC

As Graham said, your session is using an ephemeral Diffie-Hellman (DH) cipher suite: ssl_set_cipher found CIPHER 0xC

As Graham said, your session is using an ephemeral Diffie-Hellman (DH) cipher suite: ssl_set_cipher found CIPHER 0xC

@xjfromsh Why do you think that lack of a Certificate and Key Exchange message is a problem? Session resumption speeds u

The slides are now up here: https://lekensteyn.nl/files/wireshark-tls-debugging-sharkfest19us.pdf You need at least Wire

Can you double-check your process list? It should exit automatically when Wireshark is closed.

If you can absolutely not decrypt any traffic even if the key log file is correctly written and configured in Wireshark,

While the key log file is non-empty, some keys are still missing. To cross-reference the keys from the key log file, no

You indeed seem to satisfy the required conditions to use RSA private key files: TLS_RSA_WITH_AES_256_GCM_SHA384 uses

You indeed seem to satisfy the required conditions to use RSA private key files: - TLS_RSA_WITH_AES_256_GCM_SHA384 uses