This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can’t save the decrypted data in wireshark

0

I tried to save the decrypted data as a pcap file. But when I opened it it's still a encrypted one.Will it be possible to save the decrypted wireshark file? Thanks in Advance

asked 21 May '13, 00:21

Kalai's gravatar image

Kalai
16●5●5●10
accept rate: 0%

One Answer:

1

Will it be possible to save the decrypted wireshark file?

no, unfortunately that feature is not implemented. Wireshark will only show the decrypted data, but it is unable to save it into a (new) pcap file.

Regards
Kurt

answered 21 May '13, 00:24

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Whith the new export PDU functionality it will be possible to implement. It's only implemeted for SIP and Diameter currently it will also "cut off" all the lower layers e.g. the layer above SSL could be output to a new file.

(21 May '13, 05:57) Anders ♦