I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the
The test I'm using is logging on to Facebook and looking for the Decrypted SSL Data tab on Wireshark. It appears while running Windows, but it's nowhere to be found on Linux. I've also noticed that in the Protocol tab, SSL will appear among all the protocols in Windows, but it's nowhere to be found on the Linux version. Both still show TLSv1.2, so I don't believe I'm connecting to an unsecured version of Facebook.
The Linux version of Wireshark is compiled with GnuTLS 2.12.23, so that is not the issue either. Can anyone help?
asked 27 Oct '15, 09:10
Wireshark 1.10.x has some bugs that might prevent successful decryption of SSL/TLS data. Version 1.12 has seen many improvements in that area and is recommended. On Ubuntu 14.04, you can install the wireshark-dev/stable PPA:
That repository is currently maintained by the Debian maintainer of Wireshark. The current version in that repo is wireshark 1.12.8+g5b6e543-2~trusty1.
answered 29 Oct '15, 02:53