6

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the key files populated on both Windows 8.1 and Ubuntu 14.04 LTS.

The test I'm using is logging on to Facebook and looking for the Decrypted SSL Data tab on Wireshark. It appears while running Windows, but it's nowhere to be found on Linux. I've also noticed that in the Protocol tab, SSL will appear among all the protocols in Windows, but it's nowhere to be found on the Linux version. Both still show TLSv1.2, so I don't believe I'm connecting to an unsecured version of Facebook.

The Linux version of Wireshark is compiled with GnuTLS 2.12.23, so that is not the issue either. Can anyone help?

3
  • 2
    This question seems more appropriate for Wireshark support or a user forum. Commented Oct 27, 2015 at 16:02
  • the PATH of the log file may vary, depending on the web browser that you use and how you installed that browser in Linux
    – JOW
    Commented Oct 27, 2015 at 16:13
  • I can see the file being populated. I used the file browser in Wireshark to navigate to it, so I don't believe that's the issue. Commented Oct 27, 2015 at 16:15

2 Answers 2

2

In Wireshark (Ubuntu 14.04) you can Right Click the SSL stream, and go to:

Protocol Preferences > Secure Sockets Layer Preferences

Here you can add RSA Key lists where you can enter the password of the private key used to protect the communications. You can also enter a Pre-shared Key or a Pre-Master Secret log file (which I believe is what you have).

Here's a tutorial on how to decrypt SSL traffic with Wireshark in Linux.


As an alternative I would look into using a proxy like Charles to act as a man in the middle to view SSL traffic between websites. It makes it very easy to see the decrypted traffic, and you can have multiple sessions going at once. This is ideal in a closed off network since you'll have to install their CA into your trusted store.

But this is a great way for debugging/viewing secure web traffic.

4
  • we can also see the decrypted traffic by using the developer toolbars found in most modern browsers, Fiddler can also be used. but i think the question is specific to how it is done with wireshark.
    – JOW
    Commented Oct 27, 2015 at 16:29
  • 1
    This does not work with forward security (e.g. Diffie-Hellman), right?
    – phk
    Commented Oct 28, 2015 at 0:53
  • 1
    @phk That's an interesting point. The SSLKEYLOGFILE way will record the pre-master secret/master key which is all you need to decrypt traffic. There's no need to know anything about the key exchange. With the Charles proxy you'll be able to decrypt every key exchange individually, but when using EDH* you will have to perform the discrete log separately for each exchange. Good catch.
    – RoraΖ
    Commented Oct 28, 2015 at 11:57
  • the tutorial link above is broken. here is the web archive link
    – eplaut
    Commented Oct 7, 2019 at 13:01
1

Thanks everyone, but the solution was really simple. I simply had to upgrade. I was using 1.10.6 on Linux (the version on the Ubuntu software center), which had some issues regarding SSL decryption. I simply had to update it using the following commands.

sudo apt-add-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo apt-get upgrade

After that it worked fine.

Disclaimer: I also asked this question on the Wireshark Q&A forum, and got the answer there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .