Wireshark - reading encrypted data

encryption wireshark sniffing
Snarre picture Snarre · Oct 20, 2013 · Viewed 8.5k times · Source

Im trying to learn how too use Wireshark properly. And im wondering if Wireshark can read encrypted data it captures when sniffing? if so how do I initiate this?

Answer

Dev picture Dev · Oct 21, 2013

Wireshark supports decrypting SSL/TLS sessions if you provide it the private key the server uses to do key exchange. If if a cipher suite is chosen that uses ephemeral keys, you will not be able to decrypt data.

You can read more about this capability on the Wireshark wiki for SSL

Related questions

How to capture all wireless network traffic wireshark and wpa2?

Ok, so I want to do some tests on my network. I have a wireless network, with a WPA2 password. I have the password, it's my own router. I have 3 laptops in here, and I want to capture all the …

Read More
Chrome not Firefox are not dumping to SSLKEYLOGFILE variable

I'm trying to decrypt SSL packages with Wireshark as described here. I have already created a SSLKEYLOGFILE System and User variable and the log file. I have restarted my computer (running Windows 10), and opened https urls with Chrome and Firefox, …

Read More
Decrypting HTTPS traffic in Wireshark not working

I'm running Wireshark 1.8.6 on Windows Server 2008 R2 and attempting to decrypt incoming HTTPS communication in order to debug an issue I'm seeing. I have my RSA Keys list set up correctly (I think) but Wireshark will not decrypt the SSL …

Read More