I submitted this about a month ago. Did it slip through the cracks? http://www.wireshark.org/lists/wireshark-dev/200608/msg00763.html
Regards, Chris -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Maynard, Chris Sent: Wednesday, August 30, 2006 1:19 AM To: Developer support list for Wireshark Subject: [Wireshark-dev] packet-ssl bug(s)? Since SSL decryption is now supposed to be supported on the Windows installer, I thought I would try out the "snakeoil2" example posted at http://wiki.wireshark.org/SSL. First, I set the RSA keys list as specified - well almost as specified. The wiki says the file name is snakeoil2.key, but it actually extracts as rsasnakeoil2.key. Next, I opened the rsasnakeoil2.cap file. At first glance, things look pretty good. For example, if you select Frame #11, Info column shows "GET / HTTP/1.1", and the packet details pane contains a separate tree for "Hypertext Transfer Protocol", which can be expanded to show the decrypted details. Nice. However if you look at Frame #31, for example, the Info column displays "GET /icons/debian/openlogo-25.jpg HTTP/1.1", but the packet details pane doesn't actually display the decrypted data. Continuing, I then applied an ssl display filter. At this point, things seemed to go horribly wrong. Frame #11 still seemed ok at this point, but most frames, including Frame #31 now showed only "Application Data" in the Info column where more useful text was once shown. What's even weirder to me is that when you clear the ssl display filter, the Info column still displays just the "Application Data" rather than reverting back to the original text. It gets even worse. If you merely close the file, reopen it, then look at Frame #11, its Info column still displays the correct text, but now the HTTP decrypted data no longer appears. Applying the ssl filter and then clearing it now affects Frame #11 the same as all the other frames. Basically you have to exit Wireshark then restart it to ever have that Frame decrypted again. On the Windows PC, I tried the example using wireshark SVN version 19082. I also tried this with Wireshark 0.99.3 running on Linux Fedora Core 4 and had the same results. Regards, Chris ----------------------------------------- This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, retention, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Also, email is susceptible to data corruption, interception, tampering, unauthorized amendment and viruses. We only send and receive emails on the basis that we are not liable for any such corruption, interception, tampering, amendment or viruses or any consequence thereof. _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
