Revision history [back]
-w testcase_decrypted.pcap
Wireshark does not save decrypted capture files:
TLS\SSL pcap with key - save decrypted output to pcap file without the attach key
Notes:
- the syntax for setting a
uat
preference is in the-o
section of the Wireshark man page.tshark
man page needs an update. - using single quotes
'
can make the command line easier to read:
TLS decryption with Tshark and RSA keys
tshark -r your.pcap '-ouat:rsa_keys:"/path/to/key.file",""'
- sample capture and key attached to 18273: ieee80211: Wireshark gives wrong A-MSDU subframe length