This is our old Q&A Site. Please post any new questions and answers at

Hi!Is there the way to make tshark use (pre)-master-secret log file to decrypt ssl traffic as full version does ?

asked 19 Oct '15, 09:23

ArkTaS's gravatar image

accept rate: 0%

The -o option should do the trick for tshark (this works for wireshark too!):

tshark -nr input.pcap -o ssl.keylog_file:/path/to/your/SSLKEYLOGFILE
permanent link

answered 28 Oct '15, 10:24

xixel's gravatar image

accept rate: 100%

edited 29 Oct '15, 04:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦

@xixel: I accepted your answer, as it correctly answers the question. And you're right. I overlooked the word tshark in the question title AND the questions itself ;-)

(29 Oct '15, 04:13) Kurt Knochner ♦
permanent link

answered 19 Oct '15, 16:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Oct '15, 09:23

question was seen: 8,991 times

last updated: 29 Oct '15, 04:15

p​o​w​e​r​e​d by O​S​Q​A