tshark is decrypting data but output pcap file still has encrypted data

Question

I want to have pcap file with decrypted SSL data in it. I am running tshark like this-

tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: TRUE" -o "ssl.keys_list:192.168.56.101,443,http,/etc/nginx/cert.key" -o "ssl.debug_file:/tmp/ssl.log" tcp port 443 -w /tmp/ssl.pcap

When I review /tmp/ssl.log file I can see decryption is happening just fine. I can see plaintext data in it(ssl.log) but when I open /tmp/ssl.pcap in WireShark I observe that tshark is not putting plaintext data in it.

Is this expected behaviour? If so, how do I go about getting plaintext data directly in pcap file

Version info

Linux Kernel - Linux debian1 3.2.0-4-amd64

Distribution - Debian Stable

TShark version - 1.8.2

Accepted Answer

Yep, that's expected, the data is only decrypted for display purposes, the packets written to the output file are those from the input that have passed any supplied filters.

Think about what you're asking for, the protocols in your capture were originally something like ethernet -> ip -> tcp -> ssl -> payload, and you now want to "remove" the ssl layer and end up with ethernet -> ip -> tcp -> payload, so all the headers of the protocols underlying the ssl payload would need to be adjusted for lengths, checksums, sequence numbers etc.

You could use tshark to output the decrypted text and then use some other application to stuff that back into a pcap to give you the required info, but I don't know what the "other application" is.

Answer 2

As Graham said, this is expected.

But if you can use the GUI then you have access to the "Export PDUs to file" function (under the File menu) which allows you to export decrypted packets into a new PCAP file.

(Note, though, that new PCAP file will probably only be readable by Wireshark; other programs using the PCAP format probably won't understand Wireshark's special "exported PDUs" DLT value.)