[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	8925
Summary	Can't edit esp_sa file to decrypt ESP packets
Classification	Unclassified
Product	Wireshark
Version	1.10.0
Hardware	x86-64
OS	Windows 7
Status	UNCONFIRMED
Severity	Normal
Priority	Low
Component	TShark
Assignee	bugzilla-admin@wireshark.org
Reporter	jon.carmicheal@gmail.com

Build Information:
1.10.0 SVN Rev 46790 from /trunk-1.10
--
I decrypt a lot of ESP packets each with a different set of keys.  It takes a
long time to go through the GUI and enter in the IP addresses, SPI, encryption
keys, and authentication keys for each one.  So I'm trying to find a way to
automate adding those via scripts, but I haven't been able to find any way to
add them except through the GUI.  I tried editing the esp_sa file in
appdata/wireshark/ even though it says DO NOT MODIFY, but that didn't work.  I
figured I could just append the needed lines to that file.  I also tried a
tshark variation thinking I could use the CLI to decrypt the packets and save
them again decrypted, which would really be the best scenario for me since then
I could share the captures without needing to send the keys.  As a rough start
I'm trying this:

 #!/bin/bash

 FILTER='esp'
 INFILE="$1"

 SRCIP1=163.158.22.91
 DESIP1=192.171.5.130
 SPI1="0x003cb4a5"
 AK1="0x14eb37837d23363cb8190d90bca07ad804437f12"
 EK1="0x06ad1f96221ea9d023a5db61155e8e1dbf8068e682efbfda"

 tshark -R "$FILTER" -2 -r ${INFILE} \
 -o esp.enable_null_encryption_decode_heuristic:true \
 -o esp.enable_authentication_check:true \
 -o esp.enable_encryption_decode:true \
 -o esp.sa_1:IPV4\|${SRCIP1}\|${DESIP1}\|${SPI1} \
 -o esp.encryption_algorithm_1:AES-CBC \
 -o esp.authentication_algorithm_1:HMAC-SHA1 \
 -o esp.encryption_key_1:${EK1} \
 -o esp.authentication_key_1:${AK1}

But it complains here:
tshark: -o flag "esp.sa_1:IPV4|163.158.22.91|192.171.5.130|0x003cb4a5"
specifies unknown preference

Has wireshark done away with being able to specify esp sa's like this?

Thanks for any help on this issue.

-Jon

---

      You are receiving this mail because:

• You are watching all bug changes.