This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

SSL decryption only works in promiscuous mode?

0

With capture filter tcp port https I only seem to capture decrypted HTTP requests when promiscuous mode is enabled. Found the problem by accident and was wondering why this might be.

This question is marked "community wiki".

asked 15 Dec '11, 20:26

kcd's gravatar image

kcd
6●1●1●3
accept rate: 0%

One Answer:

0

It might be that you do not receive all HTTPS packets when promiscuous mode is not enabled. Or maybe you started the non-promiscuous trace without restarting the browser, which means you will see only reused ssl sessions, which do not contain the session-key exchange.

answered 17 Dec '11, 03:02

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%