This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to use (pre)-master-secret log file with tshark

1

Hi!Is there the way to make tshark use (pre)-master-secret log file to decrypt ssl traffic as full version does ?

asked 19 Oct '15, 09:23

ArkTaS's gravatar image

ArkTaS
16113
accept rate: 0%


2 Answers:

2

The -o option should do the trick for tshark (this works for wireshark too!):

tshark -nr input.pcap -o ssl.keylog_file:/path/to/your/SSLKEYLOGFILE

answered 28 Oct '15, 10:24

xixel's gravatar image

xixel
6113
accept rate: 100%

edited 29 Oct '15, 04:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237

@xixel: I accepted your answer, as it correctly answers the question. And you're right. I overlooked the word tshark in the question title AND the questions itself ;-)

(29 Oct '15, 04:13) Kurt Knochner ♦

1

answered 19 Oct '15, 16:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%