Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Derek Shinaberry
I've got it now. I knew I had to be missing something fundamental, because if I wasn't, the whole foundation of SSL would be in jeopardy. The pages I read talked about the client key exchange message sending the premaster secret from the client to the server, but neglected to mention that t

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Jeff Morriss
Well, remember, it's not *really* secure: Anybody with enough CPU time can break the encryption. And, what's worse, no one[1] can prove (or disprove) that the encryption is not breakable in much less time than is needed with brute force. [1] excepting those who purport that P=NP if P or N are

Re: [Wireshark-users] Capture Error

2007-08-10 Thread Anders Broman
Hi, Take a look at http://wiki.wireshark.org/KnownBugs/OutOfMemory Regards Anders -Ursprungligt meddelande- Från: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] För Susan Skickat: den 10 augusti 2007 17:51 Till: wireshark-users@wireshark.org Ämne: [Wireshark-users] Capture Error We are runn

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Luis EG Ontanon
Is the following intelligent dominating species that's going to evolve in our planet after we go extint will be interested in what you encrypted? On 8/10/07, Jeff Morriss <[EMAIL PROTECTED]> wrote: > > Well, remember, it's not *really* secure: Anybody with enough CPU time > can break the encrypti

[Wireshark-users] Capture Error

2007-08-10 Thread Susan
We are running Wireshark 99.6 to capture traffic leading up to a problem situation. Twice now it has failed while capturing and generates a pop-up box saying something like "We're sorry... wireshark has encountered an error" and capture stops. When you click "OK" on the error box, the product

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Luis EG Ontanon
Ack. But still I think that given the will and the power there are far better mechanisms to obtain information than cracking encryption (like bribery or extortion). On 8/10/07, Jeff Morriss <[EMAIL PROTECTED]> wrote: > > Nothing I've encrypted would be of interest, but if you're hiding from > the

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Jeff Morriss
Full ack. Luis EG Ontanon wrote: > Ack. > But still I think that given the will and the power there are far > better mechanisms to obtain information than cracking encryption (like > bribery or extortion). > > On 8/10/07, Jeff Morriss <[EMAIL PROTECTED]> wrote: >> Nothing I've encrypted would be

Re: [Wireshark-users] MATE config syntax

2007-08-10 Thread Luis EG Ontanon
The first format (C-Like) is the current one, the "second" format was the original (dropped) one. In the odd story of the accidental development of MATE this format was written for loading and testing an ISUP/H323/SIP only module, it came to my view that the matching mechanism was versatile enough

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Jeff Morriss
Nothing I've encrypted would be of interest, but if you're hiding from the all-seeing all-powerful NSA, maybe you'd care. [1,000 CPU years seems like a long time until you've got 10,000 CPUs working on the problem. 10,000 CPUs used to seem improbable but how many servers do they say Google h

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Luis EG Ontanon
If you are eavesdropping an ssl session you are not supposed to know the shared secret between the client and the server in order to avoid you decrypting what goes through client and server. The "not allowing eavsdropers" to see the clear text exchange between client and server happens to be the re

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Kukosa, Tomas
Hi, it is possible to decrypt the session if you retrieve somehow from client the master secret and some addtional information. There is not whole mechanism for it in the Wireshark now but there is function ssl_set_master_secret(). If you pass all necessary information to this function it can

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Sebastien Tandel
Fortunately for them (hum!) there are the rainbow tables ... compute once, always crack Regards, Sebastien Tandel On Aug 10, 2007, at 3:55 PM, Jeff Morriss wrote: Full ack. Luis EG Ontanon wrote: Ack. But still I think that given the will and the power there are far better mechanisms to

Re: [Wireshark-users] SSL Decryption

2007-08-10 Thread Jeff Morriss
Derek Shinaberry wrote: > Can someone help me understand why you must have the server's private > key in order to be able to decrypt the session between the client and > the server? It seems to me that if the server and client can conduct > the session without the client ever knowing the ser

[Wireshark-users] MATE config syntax

2007-08-10 Thread Sake Blok
Hi, I started to use MATE to link packets to each other in Wiresharl/Tshark and do some analysis on the set. I was able to get some things working aleady and I think it is a great plugin. I do have some questions though. When I look at the information on the Wiki I am a bit confused by the two sy

[Wireshark-users] SSL Decryption

2007-08-10 Thread Derek Shinaberry
Can someone help me understand why you must have the server's private key in order to be able to decrypt the session between the client and the server? It seems to me that if the server and client can conduct the session without the client ever knowing the server's private key, then a capt

[Wireshark-users] How does one post a message in reply to an existing thread?

2007-08-10 Thread J P
Hi Everyone, How do I post a message in reply in an existing thread and have the new message attached to the thread? Thanx, John ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users

Re: [Wireshark-users] How does one post a message in reply to an existing thread?

2007-08-10 Thread Luis EG Ontanon
just reply! On 8/10/07, J P <[EMAIL PROTECTED]> wrote: > Hi Everyone, > > How do I post a message in reply in an existing thread and have the new > message attached to the thread? > > Thanx, > > John > ___ > Wireshark-users mailing list > Wireshark-users

Re: [Wireshark-users] Portable Wireshark Settings

2007-08-10 Thread Misc
Misc wrote: >Portable Wireshark stores settings in "Application Data". Is this even >U3 compliant? :( > >How can I make it to store its "preferences" on the USB drive. In the >"Options" there is no place to specify where to store settings. It says portable wireshark is supposed to store its "prof

Re: [Wireshark-users] Portable Wireshark Settings

2007-08-10 Thread Ulf Lamping
Misc schrieb: > Misc wrote: > > >> Portable Wireshark stores settings in "Application Data". Is this even >> U3 compliant? :( >> >> How can I make it to store its "preferences" on the USB drive. In the >> "Options" there is no place to specify where to store settings. >> > > It says portabl

[Wireshark-users] How does one post a message in reply to an existing thread?

2007-08-10 Thread J P
How do I post a message in reply to an existing thread using the HTML List Viewer? Thanx, John ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users

Re: [Wireshark-users] Capture Error

2007-08-10 Thread Jaap Keuter
Hi, I've been doing the same for a couple of months now, and no problems. Only (significant!) difference is that I use dumpcap to capture into a circular buffer. Then I pick up the files I'm interested in and decode them using wireshark. My guess is you can work out a similar scheme. Thanx, Jaa