Hi All, I have a problem when time to time wireshark decrypted only partial sip flow. And sometimes decrypted full flow. Such change in decryption happens randomly and I need to know what is wrong when wireshark can't decrypt full flow. For example on following capture sip session (call) started from 4418 packet - on this packet Originator sent INVITE to SIP PROXY but INVITE from SIP PROXY to Terminator wasn't decrypted. Another marked packet on this capture 2411 on which you can that messages from Terminator was decrypted successfully 15 seconds ago. [link to picture]2 On the same capture I'm changed display filter to SSL and see that actually packets was captured but not decrypted: [link to picture]4 Packets 4423 and 4424 weren't decrypted. From SSL debug log:
Can anybody suggest how to deal with this the problem? I'm using wireshark Version 1.10.3. Capturing with following tshark command:
Of course private key from certificate was imported to wireshark via wireshark GUI. asked 30 Nov '13, 15:02 m2a0x edited 30 Nov '13, 15:27 |