SSL decryption only works in promiscuous mode?

With capture filter tcp port https I only seem to capture decrypted HTTP requests when promiscuous mode is enabled. Found the problem by accident and was wondering why this might be.

This question is marked "community wiki".

asked 15 Dec '11, 20:26

kcd
6●1●1●3
accept rate: 0%

One Answer:

active answers oldest answers newest answers popular answers

It might be that you do not receive all HTTPS packets when promiscuous mode is not enabled. Or maybe you started the non-promiscuous trace without restarting the browser, which means you will see only reused ssl sessions, which do not contain the session-key exchange.

permanent link

answered 17 Dec '11, 03:02

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

ssl ×319
https ×69
troubleshooting ×53
promiscuous ×43

question asked: 15 Dec '11, 20:26

question was seen: 2,885 times

last updated: 17 Dec '11, 03:02

SSL decryption only works in promiscuous mode?

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions