6

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the key files populated on both Windows 8.1 and Ubuntu 14.04 LTS.

The test I'm using is logging on to Facebook and looking for the Decrypted SSL Data tab on Wireshark. It appears while running Windows, but it's nowhere to be found on Linux. I've also noticed that in the Protocol tab, SSL will appear among all the protocols in Windows, but it's nowhere to be found on the Linux version. Both still show TLSv1.2, so I don't believe I'm connecting to an unsecured version of Facebook.

The Linux version of Wireshark is compiled with GnuTLS 2.12.23, so that is not the issue either. Can anyone help?

  • 2
    This question seems more appropriate for Wireshark support or a user forum. – Neil Smithline Oct 27 '15 at 16:02
  • the PATH of the log file may vary, depending on the web browser that you use and how you installed that browser in Linux – JOW Oct 27 '15 at 16:13
  • I can see the file being populated. I used the file browser in Wireshark to navigate to it, so I don't believe that's the issue. – user2132167 Oct 27 '15 at 16:15
2

In Wireshark (Ubuntu 14.04) you can Right Click the SSL stream, and go to:

Protocol Preferences > Secure Sockets Layer Preferences

Here you can add RSA Key lists where you can enter the password of the private key used to protect the communications. You can also enter a Pre-shared Key or a Pre-Master Secret log file (which I believe is what you have).

Here's a tutorial on how to decrypt SSL traffic with Wireshark in Linux.


As an alternative I would look into using a proxy like Charles to act as a man in the middle to view SSL traffic between websites. It makes it very easy to see the decrypted traffic, and you can have multiple sessions going at once. This is ideal in a closed off network since you'll have to install their CA into your trusted store.

But this is a great way for debugging/viewing secure web traffic.

  • we can also see the decrypted traffic by using the developer toolbars found in most modern browsers, Fiddler can also be used. but i think the question is specific to how it is done with wireshark. – JOW Oct 27 '15 at 16:29
  • 1
    This does not work with forward security (e.g. Diffie-Hellman), right? – phk Oct 28 '15 at 0:53
  • 1
    @phk That's an interesting point. The SSLKEYLOGFILE way will record the pre-master secret/master key which is all you need to decrypt traffic. There's no need to know anything about the key exchange. With the Charles proxy you'll be able to decrypt every key exchange individually, but when using EDH* you will have to perform the discrete log separately for each exchange. Good catch. – RoraΖ Oct 28 '15 at 11:57
1

Thanks everyone, but the solution was really simple. I simply had to upgrade. I was using 1.10.6 on Linux (the version on the Ubuntu software center), which had some issues regarding SSL decryption. I simply had to update it using the following commands.

sudo apt-add-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo apt-get upgrade

After that it worked fine.

Disclaimer: I also asked this question on the Wireshark Q&A forum, and got the answer there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.