Hello
I want to see the SIP communication between my server and an endpoint which is on SIP TLS. I have the private key from the server and captured the initial handshake. However I'm not able to decrypt the messages. Is there anything I'm missing? You perhaps spot something in the log which i don't.
dissect_ssl enter frame #28 (first time)
ssl_session_init: initializing ptr 000000000A182FA0 size 712
association_find: TCP port 32941 found 0000000000000000
packet_from_server: is from server - FALSE
conversation = 0000000006DE15D8, ssl_session = 000000000A182FA0
record: offset = 0, reported_length_remaining = 195
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 190, ssl state 0x00
association_find: TCP port 32941 found 0000000000000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 1 offset 5 length 186 bytes, remaining 195
packet_from_server: is from server - FALSE
ssl_find_private_key server 172.19.253.22:5061
ssl_find_private_key: testing 1 keys
dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
dissect_ssl enter frame #35 (first time)
packet_from_server: is from server - TRUE
conversation = 0000000006DE15D8, ssl_session = 000000000A182FA0
record: offset = 0, reported_length_remaining = 1448
dissect_ssl enter frame #36 (first time)
packet_from_server: is from server - TRUE
conversation = 0000000006DE15D8, ssl_session = 000000000A182FA0
record: offset = 0, reported_length_remaining = 128
dissect_ssl enter frame #47 (first time)
packet_from_server: is from server - FALSE
conversation = 0000000006DE15D8, ssl_session = 000000000A182FA0
record: offset = 0, reported_length_remaining = 214
dissect_ssl3_record found version 0x0301(TLS 1.0) -> state 0x11
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 150, ssl state 0x11
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 16 offset 5 length 146 bytes, remaining 155
ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 11
ssl_generate_pre_master_secret: not enough data to generate key (required state 17)
dissect_ssl3_handshake can't generate pre master secret
record: offset = 155, reported_length_remaining = 59
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
record: offset = 161, reported_length_remaining = 53
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 48, ssl state 0x11
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 43 offset 166 length 3990203 bytes, remaining 214
dissect_ssl enter frame #50 (first time)
packet_from_server: is from server - TRUE
conversation = 0000000006DE15D8, ssl_session = 000000000A182FA0
record: offset = 0, reported_length_remaining = 6
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - TRUE
ssl_change_cipher SERVER
dissect_ssl enter frame #54 (first time)
packet_from_server: is from server - TRUE
conversation = 0000000006DE15D8, ssl_session = 000000000A182FA0
record: offset = 0, reported_length_remaining = 53
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 48, ssl state 0x11
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 240 offset 5 length 12105667 bytes, remaining 53
asked 18 Nov ‘15, 08:03
romo
6●1●1●3
accept rate: 0%
edited 18 Nov ‘15, 08:12
Lekensteyn
2.2k●3●7●24
Please include the Wireshark version you are using. Is this the full debug log? I don’t see the Server Hello which mentions the cipher suite that is in use. Very likely your client is using a cipher suite with the Diffie-Hellman key exchange. See this post for investigating further.
i use WS version 1.12.8 You can see the full log here: https://sprend.com/download.htm?C=0825d50fef974fb7b1b69b9e39a71224 i’ve been checking the posts with the DHE issue but i couldn’t find similarities to my problem(besides i cannot decrypt it)
This is the content of the file. Not enough to analyze the problem.
Hello Kurt Yes very short indeed. No idea why i only posted this part. Please try here again: https://www.dropbox.com/s/dz3qp35at2fyq90/wslog.txt?dl=0