encryptionwiresharksniffing

Wireshark - reading encrypted data


I'm trying to learn how to use Wireshark properly and I'm wondering if Wireshark can read encrypted data it captures when sniffing? If so, how do I initiate this?


Solution

  • Wireshark supports decrypting SSL/TLS sessions if you provide it the private key the server uses to do key exchange. If if a cipher suite is chosen that uses ephemeral keys, you will not be able to decrypt data. UPDATE: Some TLS libraries can now dump per session key exchange secrets to a file for debugging. Wireshark can use that to decrypt the relevant TLS sessions even if ephemeral keys are used.

    You can read more about this capability on the Wireshark wiki for SSL.

    See also this linked answer for How to view Encrypted Application Data in Wireshark