Re: Trying to decode sshv2 traffic

[M Holt <m.iostreams () gmail com>]

SSH uses Diffie-Hellman key exchange, which creates a shared 'ephemeral'
key for encryption. As such, there is no current method of decrypting this
type of traffic. For more info, take a look here:
http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange


On Tue, Jun 17, 2014 at 1:41 PM, Ahmed Zaki <ahmed.mahmoudzaki () gmail com>
wrote:

> Thank you Jeff.
>
> Do you think we can submit it as a future enhancement?
>
>
>
> On Tue, Jun 17, 2014 at 8:16 PM, Jeff Morriss <jeff.morriss.ws () gmail com>
> wrote:
>
> > On 06/17/14 12:59, Ahmed Zaki wrote:
> >
> > > Dear All,
> > >
> > > I captured SSHV2 trace file between two servers, I want to see the
> > > decrypted packets.
> > >
> > > Any ideas about how I can decrypt the packets?
> > >
> > > I believe it is possible to collect the public keys from both servers,
> > > Is this going to help?
> >
> > Unfortunately, no.  The SSH dissector in Wireshark is not able to decrypt
> > SSH packets.
> >
> > See:
> >
> > http://wiki.wireshark.org/SSH
> > ____________________________________________________________
> > _______________
> > Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> > Archives:    http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> >             mailto:wireshark-users-request () wireshark org?subject=
> > unsubscribe
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe