I have Wireshark setup to decrypt and display packets in realtime. But I need to have them written to file in realtime also. Someone suggested Tshark, but I can only get it to write to file and not decrypt. Here are the command line parameters I tried:

"C:\Program Files\Wireshark\tshark.exe" -i 7 -w "C:\Users\My Name\Desktop\packets.pcap" -o ssl.keys_list:,443,http,SSLKEYLOG

I've tried different variations of that but none of them result in the decrypted packets being written to file, they are still encrypted. It doesn't even give an error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.