I would like to get the column Info from Wiresjark to display the SSH Encrypted packet len info as displayed in the following picture
But actually I cannot show any info in that column as you can see in the link below.
It may be because of the attempt Wireshark makes at decrypting the SSH protocol, but not falling back to the default behaviour if it can't. Then it should simply add the same information to the info column as shown above.
The picture above was probably created using Wireshark 3.6 or older, which didn't have this capability. Maybe I can have a look next week to see if this can be improved upon.
Using 4.0.10, the handshake packets add to the info column but all further encrypted packets simply show the Client: or Server: direction. I'm not sure that the display of Encrypted packet (len=xxx) adds much, presumably that was dropped at some later point.
Comments
It would help if you could state the Wireshark versions with which these screenshots were made.
Jaap, I'm currently using Wireshark version 4.0.7, but I uncertain about which version this wirehark belongs to, since I have found that picture on this website.
Does it show "len=" with capture attached to 9006: SSH: dissect (and use) both Key Exchange Init messages?