I am not able to decrypt SSL sessions in Wireshark. Does anyone know what is wrong? Thanks for any assistance.
Here is the debug output:
ssl_init private key file B:\downloads\certs\server1-rsa.key successfully loaded.
association_add TCP port 443 protocol http handle 059E54D0
dissect_ssl enter frame #4 (first time)
ssl_session_init: initializing ptr 06571BC4 size 588
conversation = 06571838, ssl_session = 06571BC4
record: offset = 0, reported_length_remaining = 177
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 172, ssl state 0x00
association_find: TCP port 34237 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 1 offset 5 length 168 bytes, remaining 177
packet_from_server: is from server - FALSE
ssl_find_private_key server 192.168.168.136:443
dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
dissect_ssl enter frame #5 (first time)
conversation = 06571838, ssl_session = 06571BC4
record: offset = 0, reported_length_remaining = 1024
dissect_ssl3_record found version 0x0301 -> state 0x11
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 57, ssl state 0x11
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 53 bytes, remaining 62
dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
ssl_restore_session can't find stored session
dissect_ssl3_hnd_srv_hello can't find cipher suite 0xC014
record: offset = 62, reported_length_remaining = 962
need_desegmentation: offset = 62, reported_length_remaining = 962
dissect_ssl enter frame #7 (first time)
conversation = 06571838, ssl_session = 06571BC4
record: offset = 0, reported_length_remaining = 2422
need_desegmentation: offset = 0, reported_length_remaining = 2422
dissect_ssl enter frame #9 (first time)
conversation = 06571838, ssl_session = 06571BC4
record: offset = 0, reported_length_remaining = 3559
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 3554, ssl state 0x13
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 11 offset 5 length 3550 bytes, remaining 3559
dissect_ssl enter frame #11 (first time)
conversation = 06571838, ssl_session = 06571BC4
record: offset = 0, reported_length_remaining = 679
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 655, ssl state 0x13
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 12 offset 5 length 651 bytes, remaining 660
record: offset = 660, reported_length_remaining = 19
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 14, ssl state 0x13
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 13 offset 665 length 6 bytes, remaining 679
dissect_ssl3_handshake iteration 0 type 14 offset 675 length 0 bytes, remaining 679
dissect_ssl enter frame #13 (first time)
conversation = 06571838, ssl_session = 06571BC4
record: offset = 0, reported_length_remaining = 214
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 7, ssl state 0x13
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 11 offset 5 length 3 bytes, remaining 12
record: offset = 12, reported_length_remaining = 202
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 138, ssl state 0x13
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 16 offset 17 length 134 bytes, remaining 155
dissect_ssl3_handshake wrong encrypted length (34052 max 134)
record: offset = 155, reported_length_remaining = 59
dissect_ssl3_record: content_type 20
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
record: offset = 161, reported_length_remaining = 53
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 48, ssl state 0x13
packet_from_server: is from server - FALSE
decrypt_ssl3_
asked 09 May ‘14, 10:56
lchen
11●1●1●2
accept rate: 0%
edited 09 May ‘14, 11:29
Kurt Knochner ♦
24.8k●10●39●237