I have Wireshark setup to decrypt and display packets in realtime. But I need to have them written to file in realtime also. Someone suggested Tshark, but I can only get it to write to file and not decrypt. Here are the command line parameters I tried:
"C:\Program Files\Wireshark\tshark.exe" -i 7 -w "C:\Users\My Name\Desktop\packets.pcap" -o ssl.keys_list:127.0.0.1,443,http,SSLKEYLOG
I've tried different variations of that but none of them result in the decrypted packets being written to file, they are still encrypted. It doesn't even give an error.