Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread authesserre samuel
Hi, The first part of the log file say : the key is correctly registred for this port (127.0.0.1:3700 associated with server.key) but the second part of the log file show that youre trying to decrypt data on 11.38.144.142:3700 this can't work try to replace 127.0.0.1 by the IP address of youre

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread Andrew Schweitzer
authesserre samuel wrote: Hi, The first part of the log file say : the key is correctly registred for this port (127.0.0.1:3700 associated with server.key) but the second part of the log file show that youre trying to decrypt data on 11.38.144.142:3700 this can't work try to replace

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread Andrew Schweitzer
Andrew Schweitzer wrote: authesserre samuel wrote: Hi, The first part of the log file say : the key is correctly registred for this port (127.0.0.1:3700 associated with server.key) but the second part of the log file show that youre trying to decrypt data on 11.38.144.142:3700 this can't work

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread authesserre samuel
Hi, To work this have to be compiled with gnutls (+ libgcrypt) support maybe that in the windows 0.99.3 installer this features is missing ? (I'm not a windows user so I can't help you) On linux box to compile you have to install gnuTLS and libgcrypt before compiling wireshark soIt's maybe an

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread Andrew Schweitzer
Andrew Schweitzer wrote: Andrew Schweitzer wrote: authesserre samuel wrote: Hi, The first part of the log file say : the key is correctly registred for this port (127.0.0.1:3700 associated with server.key) but the second part of the log file show that youre trying to decrypt data on

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread Small, James
When I use 0.99.3 for Windows, I also have trouble with the SSL decodes. When I use the Wiki example and look at the logs, I see: In the logs, I keep seeing decrypt ssl3 record: no session key Logs: association_remove_handle removing ptr 02D39200 handle 0282E918 association_remove_handle

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread support
Sorry for my ignorance. Where can I find this log file?Thanks.KimOn 9/12/06, Small, James [EMAIL PROTECTED] wrote:When I use 0.99.3 for Windows, I also have trouble with the SSL decodes. When I use the Wiki example and look at the logs, I see:In the logs, I keep seeing decrypt ssl3 record: no

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread Andrew Schweitzer
Andrew Schweitzer wrote: Andrew Schweitzer wrote: ...and now it stopped working again on Version 0.99.4 (SVN Rev 19056), even after restarting... hm... By very carefully editing the wireshark preferences file (in documents and settings\application data\Wireshark), it seems to decode

[Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread Andrew Schweitzer
Hello, I'm trying to decrypt some SSL traffic. The connection initiator talk to port 37000. It talks a proprietary protocol (one not present in wireshark). I have the keys of the initiator and the listener. I am capturing on the listener. What should my RSA keys list be? Should it be:

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread ronnie sahlberg
On 9/12/06, Andrew Schweitzer [EMAIL PROTECTED] wrote: Hello, I'm trying to decrypt some SSL traffic. The connection initiator talk to port 37000. It talks a proprietary protocol (one not present in wireshark). I have the keys of the initiator and the listener. I am capturing on the listener.

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread Ulf Lamping
ronnie sahlberg wrote: On 9/12/06, Andrew Schweitzer [EMAIL PROTECTED] wrote: Hello, I'm trying to decrypt some SSL traffic. The connection initiator talk to port 37000. It talks a proprietary protocol (one not present in wireshark). I have the keys of the initiator and the listener. I

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread Andrew Schweitzer
ronnie sahlberg wrote: On 9/12/06, Andrew Schweitzer [EMAIL PROTECTED] wrote: Hello, I'm trying to decrypt some SSL traffic. The connection initiator talk to port 37000. It talks a proprietary protocol (one not present in wireshark). I have the keys of the initiator and the listener. I am

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread Andrew Schweitzer
Andrew Schweitzer wrote: ronnie sahlberg wrote: [snip] try: 127.0.0.1,3700,data,e:\keys\server.key That worked better. Wireshark now knows it's looking at SSL and parses the SSL header... but it doesn't seem to decrypt the data. Any suggestions on how to debug this? PS, when I

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread ronnie sahlberg
can you try to put the key file in the same directory as the traceand specify the key file without a path : 127.0.0.1,3700,data,server.keyOn 9/13/06, Andrew Schweitzer [EMAIL PROTECTED] wrote:Andrew Schweitzer wrote: ronnie sahlberg wrote: [snip] try:127.0.0.1,3700,data,e:\keys\server.key That

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread Andrew Schweitzer
ronnie sahlberg wrote: can you try to put the key file in the same directory as the trace and specify the key file without a path : 127.0.0.1 http://127.0.0.1/,3700,data,server.key hm... same result. ___ Wireshark-users mailing list

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-12 Thread Andrew Schweitzer
ronnie sahlberg wrote: can you try to put the key file in the same directory as the trace and specify the key file without a path : 127.0.0.1 http://127.0.0.1/,3700,data,server.key Log file says it found key, but also that it couldn't find key for server. Does that make any sense?