On May 4, 2018, at 10:07 AM, Ahmad Fatoum <ahmad@xxxxxx> wrote:
>> On 4May 2018, at 01:13, Ben Higgins <ben@xxxxxxxxxxxx> wrote:
>>
>> What I'd like to do is instead create a new pcap-ng block type that we can put SSL keylog file contents into verbatim.
>
> How about a generic "Wireshark dissector preferences" pcapng block with { pref.key => value } tuples?
> e.g. { ssl.keys_list => "127.0.0.1,4443,http,/home/dirkx/xx/privkey.pem" }
That might *also* be useful, but the advantage of blocks that *aren't* tied to Wireshark is that *other* programs can use the data without having to track Wireshark.
