Wireshark-users: Re: [Wireshark-users] need help with decrypting ssl messages

From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Sun, 17 Oct 2010 21:46:11 -0600
On Thu, Oct 14, 2010 at 12:14:34PM -0700, Al wrote:

>  123.456.55.678,443,http,C:\testkey.pem
>  
>  I tried both http and https - i thought since i am talking to server 
>  in https it might be https?

That field is for the protocol contained within the SSL packets, which 
is most likely in your case, http.  Other common values could be pop3, 
imap, etc.