Differences

This shows you the differences between two versions of the page.

--- tech-notes:wireshark [2020/07/17 14:39] – [Decrypting TLS Browser Session] gerardorourke
+++ tech-notes:wireshark [2022/03/03 12:35] (current) – [Decrypting TLS Browser Session] gerardorourke
@@ Line 54: / Line 54: @@
 ===== Decrypting TLS Browser Session =====
-Reference: https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/\\
+https://wiki.wireshark.org/TLS
-  * Set the System Environnment variable **SSLKEYLOGFILE**, e.g. SSLKEYLOGFILE=C:\X-Support\SSL\SSLKeyLog.log
+  * Set the System Environment variable **SSLKEYLOGFILE**, e.g. SSLKEYLOGFILE=C:\X-Support\SSL\SSLKeyLog.log
   * Set Pre-Master Secret Log filename in the Wireshark\Preferences\Protocols\SSL - as per below
   * Use Chrome or Firefox
@@ Line 62: / Line 62: @@
 {{:tech-notes:ssl-wireshark.jpg?400|}}
-===Changed!=====
-run chrome with argument e.g.: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --ssl-key-log-file=%SSLKEYLOGFILE%
-<code>
-chrome.exe --ssl-key-log-file=%SSLKEYLOGFILE%
-</code>
-Also note - latest wiresharks have this setting in the protocol 'TLS' and not the legacy protocol SSL
-=== Firefox ====
-  *https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format
 === For Java / Tomcat ===
@@ Line 79: / Line 68: @@
+==== Embedding decryption secrets in a pcapng file ====
+Since Wireshark 3.0 you can embed the TLS key log file in a pcapng file. This makes it much easier to distribute capture files with decryption secrets, and makes switching between capture files easier since the TLS protocol preference does not have to be updated. To add the contents of key log file keys.txt to capture file in.pcap and write the result to out-dsb.pcapng:
+<code>editcap --inject-secrets tls,keys.txt in.pcap out-dsb.pcapng</code>