I would like to export the decrypted data from certain packets in my pcap file to a text file (preferably csv file). I know that right now tshark does not support decryption. How do I use wireshark to save decrypted data. I tried "export PDU">"dlt USer" option but the new file that gets loaded in wireshark is empty. Not quite sure what is going on. Is there any other option? asked 17 Jan '16, 13:35  hvs |
One Answer:
Read carefully (till the very last comment) the answer thread of this older question. You won't get csv but you will get the decrypted data in xml. answered 17 Jan '16, 13:48  sindy |
