Hi, We are trying to use tShark to decrypt SSL communication in our network. We have one web server with multiple sites on it. So we use a single Certificate and it all works from port 443. tShark is installed on Linux (SLUES) to be exact. We are able to see decrypted messages for some of the web sites on this web site but not all. When I run it in debug mode I see below error messages. What is interesting is that we always see messages to some of the web sites but some of the other ones it never gets decrypted as if its specific to the site even though they are all running on the same server and the same port using the same server side certificate. This is an urgent issue for us so any help is greatly appreciated. Thanks Al ssl_init keys string: 192.168.15.30,443,http,/home/application/cert.pem ssl_init found host entry 192.168.15.30,443,http,/home/application/cert.pem ssl_init addr 192.168.15.30 port 443 filename /home/application/cert.pem ssl_init private key file /home/application/cert.pem successfully loaded association_add TCP port 443 protocol http handle 0x81e3288 association_find: TCP port 636 found 0x86868b0 ssl_association_remove removing TCP 636 - ldap handle 0x81f9250 association_add TCP port 636 protocol ldap handle 0x81f9250 association_find: TCP port 993 found 0x86868e8 ssl_association_remove removing TCP 993 - imap handle 0x81d1c18 association_add TCP port 993 protocol imap handle 0x81d1c18 association_find: TCP port 995 found 0x8686920 ssl_association_remove removing TCP 995 - pop handle 0x8255678 association_add TCP port 995 protocol pop handle 0x8255678 dissect_ssl enter frame #10 (first time) ssl_session_init: initializing ptr 0xb48c2988 size 564 association_find: TCP port 40685 found (nil) packet_from_server: is from server - FALSE dissect_ssl server 192.168.15.30:443 dissect_ssl3_record found version 0x0301 -> state 0x10 dissect_ssl3_record: content_type 21 decrypt_ssl3_record: app_data len 22 ssl, state 0x10 association_find: TCP port 40685 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #18 (first time) ssl_session_init: initializing ptr 0xb48c2de0 size 564 association_find: TCP port 40686 found (nil) packet_from_server: is from server - FALSE dissect_ssl server 192.168.15.30:443 dissect_ssl3_record: content_type 22 decrypt_ssl3_record: app_data len 143 ssl, state 0x00 association_find: TCP port 40686 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 139 bytes, remaining 148 dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
_______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users