https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3444
--- Comment #3 from Sake <sake@xxxxxxxxxx> 2009-04-29 10:00:11 PDT ---
(In reply to comment #2)
> > $ tshark -o ssl.keys_list:192.168.100.217,443,http,c:\\key.txt -r full.cap -V
> > -c 1 http
>
> Thank you, that does output the decrypted headers and data in text form and
> definitely gets me 80% of what I need.
What would be the other 20%?
> Ultimately, I was trying to get the output back into Wireshark for analysis
> using the GUI, and I played with setting output formats so that I could
> re-import the decrypted output from tshark...but no luck. Any hints?
The libpcap file format does not have the possibility to add extra info into
the tracefile. It's just a bunch of records with a header (timestamp etc) and
packet-data as it was seen on the NIC.
What I usually do is provide the pcap file and the decrypted output, which
kinda provides all info.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.