Unable to decrypt the esp packets to extract SIP messages using esp_sa file saved in the location where the pcap file mycapture.pcap is present. esp_sa file contents: "IPv6","","","*","null","0X7B632E001C303C3C22CFADBF08D6D04F","HMAC-SHA-1-96","0XF7EDFD9700F446B1A6C9596070C6EA71" tshark command: tshark -nr mycapture.pcap -o esp.enable_encryption_decode:TRUE -o esp.enable_null_encryption_decode_heuristic:TRUE -o esp.enable_authentication_check:TRUE I'm looking for way where this can be automated with the keys in esp_sa file. Looking forward for some help. Thanks, Irina asked 19 Aug '15, 12:08  arathika |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
I'am looking to decrypt esp packets using tshark by dynamically generating the file esp_sa. Is there a tshark command that can use the keys from esp_sa file and decrypt the esp packets with having to set this through edit->preference->esp>edit esp_sa's manually