Wireshark-dev: Re: [Wireshark-dev] [pcap-ng-format] Proposal for storing decryption secrets in
Guy Harris <guy@xxxxxxxxxxxx> wrote:
> The second and third option require either the producer, or some
> post-processor, to write a new version of the file putting the secrets
> before the packets that require them. The producer isn't necessarily
> responsible for doing so; one might have tcpdump, or dumpcap (or some
> program using dumpcap, such as TShark or Wireshark) write out a capture
> with no secrets, and then have another program (a utility, or Wireshark
> after having read in the file and then given the secret in question)
> write out a new file with the secrets early enough in the file ("before
> all the packet blocks" is probably the simplest implementation).
I'm in favour of this option, and providing a signal early in the file that
the indicates if that process has occured yet.
> A producer that *does* happen to have the secret available before
> seeing any packets that require the secret *could* write it directly.
Agreed.
--
] Never tell me the odds! | ipv6 mesh networks [
] Michael Richardson, Sandelman Software Works | network architect [
] mcr@xxxxxxxxxxxx http://www.sandelman.ca/ | ruby on rails [
