I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though perhaps not necessarily so). In both cases I can view the EAP contents in Wireshark, and I can drill down as far as TLS negotiation/handshaking, and the encrypted TLS bytes.
It would be handy for me to see the contents of the encrypted data itself, as it contains yet further layers of the authentication exchange that I am investigating.
All of this has been generated using my own test-systems so I have all of the information available, certs etc. and I know what should be in the encrypted TLS data.
I have followed the Wireshark tutorial, pretty much to the letter. http://wiki.wireshark.org/SSL
But I am not having much luck with this, and I am worried that perhaps Wireshark only knows how to deal with less tricky TLS cases, i.e. your day to day, common or garden SSL protocols such as those running over TCP such as HTTP, SSH, RADIUS, SCP etc.
I'm looking at the slightly more complex case of SSL over EAP over RADIUS over UDP on the one hand, and the even more specialised SSL over EAP over EAPoL on the other.
I "think" I may be seeing the app-data decrypted in one or two of the EAP packets, where the handshake information is present, but this information doesn't seem to be getting carried across to the rest of them.
Could it be that I'm just too far out in the weeds here? Or maybe there's something I'm missing, it certainly seems like it should be possible.
I'm sure I can work around this somehow by decrypting offline (or perhaps using the NULL cypher) but I thought I'd be sure I've exhausted all avenues with wireshark first.