Unsniff lists all the TCP sessions seen as top level objects. Locate the plaintext sessions (completely stripped of TLS) Locate the TLS section and set the 'Analyzer Upper Layers' to TrueĬlick on the Import from TCPDUMP icon 4. Enable 'Analyze Upper Layers of TLS' option Use the private key to decrypt live or captured traffic.Įnter the Server IP and Port and specify the private key file 2. Let us look at how you can export the plain text into libpcap format.įor more details check out this article 1. You can then fire up Wireshark to examine the plaintext pcap file. Unsniff allows you to copy the plain text TCP streams and paste them as libpcap files. If you want to use Wireshark, you need a libpcap format file.

The USNF file format stores the decrypted result and you do not need the key anymore.

The server admin now leaves the room and takes the key with him.

You were able to decrypt the traffic you wanted.

You got the server admin to enter the private key.

In this article we look at a common problem many network analysts face when dealing with SSL/TLS decryption. Welcome the the first article in the new Unsniff Network Analyzer Tips section.

Export plain text pcap after SSL/TLS decryption

Wireshark tls decrypt with private key