Hi,
I've got tshark running fine with decryption for ssl traffic, but I was wondering....
In order for ssl to decrypt properly the ssl.handshake has to be in the tracefile. If I'm using a ring buffer for capturing to keep the file sizes down for analyzing, for instance 5 50mb tracefiles, and the ssl.handshake is in the 1st trace file, how does wireshark handle decrypting ssl traffic within the subsequent trace files, like file 2, 3, 4 and 5 of the capture for instance?
Thanks,
John