Do you have any example captures to test it with?
On 11/24/05, Paolo Abeni <paolo.abeni@xxxxxxxx> wrote:
> hi all,
>
> The attached patch is an updated version of the previous one I posted
> some time ago. I reworked a large part of the code. It links against
> gnutls and support also the AES encryption algorithm. The patch modify
> some autoconf related files, so you need to invoke 'autogen.sh' after
> applying the patch.
>
> A few notes:
>
> You need the gnutls and libgcrypt devel package to compile the patched
> version of ethereal.
>
> To activate the decryption:
>
> - start ethereal
> - edit the preference
> - search and select the SSL item in the Protocol list
> - put into the 'RSA private keys list' field the private key information
> in the following format:
> <1# host IP>:<port>:<RSA private key file used from ssl>[, <IP>:KEY]
> - start the capture
>
> Even with the private key, only RSA key exchange can 'opened'/decrypted.
> To be sure that your apache web server use only RSA Key Exchange, find
> the SSLCipherSuite diirective in the configuration file and add at the
> end of that line: ':!DH:!EDH:!ADH' (without the quote ').
> If your configuration does not contain the SSLCiperSuite directive (and
> thus you are using the default value), simply add the following line to
> your config file:
>
> SSLCipherSuite ALL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:!DH:!
> EDH:!ADH
>
> This will disable all non RSA key exchange.
>
> Find the SSLCertificateKeyFile directive. That will tell you the path of
> the RSA private key. Copy it on the host where ethereal is installed.
> If you can't find the SSLCertificateKeyFile directive, look for the
> SSLCertificateFile directive.
>
> The full path of the key file on the host running ethereal is what you
> need to put into the 'RSA private keys list' in SSL protocol preference
> (see above).
>
> SSLv2 record are just ignored by the decryption code: it's possible to
> decrypt only SSLv3/TLS1 sessions.
>
> best regards,
>
> Paolo Abeni
>
>
>
> --
> Email.it, the professional e-mail, gratis per te: http://www.email.it/f
>
> Sponsor:
> Vuoi bere tanta acqua pura e risparmiare ben 495 euro all'anno?
> * Con BeviSano avrai finito di comprare acqua in bottiglia - clicca qui
> Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3628&d=24-11
>
