Wireshark-users: Re: [Wireshark-users] SSL issue not decoding data

From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 1 May 2008 23:54:21 +0200

On Thu, May 01, 2008 at 02:28:54PM -0700, jacob c wrote:
> Hello,
>    
>   I am trying to view a SSL session. Based on the debug file 
> it looks like the key is loading correctly but I can't see any 
> of the HTTP requests. The packets still show it as "Encrypted 
> Application".  I do so some of these errors in the log:
>   decrypt_ssl3_record: no decoder available
>    
>   I am attaching the debug file to this message in case anybody 
> wants to look at it. Can someone tell me what I might be doing wrong?

Sure, no problem...

[...]
> ssl_restore_session can't find stored session

This line indicates that the SSL session at hand is actually a reused
SSL session with a short handshake. Wireshark needs the full SSL handshake
to be able to calculate all the keys.

Best practice is to start capturing before you start up the browser. 

Hope this helps,
Cheers,
    Sake