How wireshark is deciphering the conversation in QUIC?

[Rodrigo Alvarez Dominguez]

Hi

I have seen that Wireshark 2.4.7 allows the following option

Force decode all Quic Decode.  How does it work?  Is Wireshark getting the master keys?

In upper versions of Wireshark 2.6.2 this option is not allowed.

Thanks in advance

Rodrigo

[Alexis La Goutte]

Hi Rodrigo,

On Fri, May 25, 2018 at 9:59 PM Rodrigo Alvarez Dominguez <rodr...@gmail.com> wrote:

Hi

I have seen that Wireshark 2.4.7 allows the following option

Force decode all Quic Decode.  How does it work?  Is Wireshark getting the master keys?

No... it is only "Force" Decode (there is some implementation using cleartext for debug stuff...)
 

In upper versions of Wireshark 2.6.2 this option is not allowed.

Because QUIC dissector is now IETF QUIC dissector and you need to look gQUIC dissector to get option

Cheers

Thanks in advance

Rodrigo

--
You received this message because you are subscribed to the Google Groups "QUIC Prototype Protocol Discussion group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to proto-quic+...@chromium.org.
To post to this group, send email to proto...@chromium.org.
For more options, visit https://groups.google.com/a/chromium.org/d/optout.

[Rodrigo Alvarez Dominguez]

Hi

Thanks for your answer. I Will try to use Gquic dissector. Any recommendation about how to do that?

Regards

[Alexis La Goutte]

On Sat, May 26, 2018 at 10:59 AM Rodrigo Alvarez Dominguez <rodr...@gmail.com> wrote:

Hi

Thanks for your answer. I Will try to use Gquic dissector. Any recommendation about how to do that?

for last gQUIC release (Q04x), it is recommended to use nighty build https://www.wireshark.org/download/automated/

and it is no possible to decrypt gQUIC (and not really planned) but it is already possible with IETF QUIC https://github.com/quicwg/base-drafts/wiki/Tools#wireshark
 

[Rodrigo Alvarez Dominguez]

Thanks

[Rodrigo Alvarez Dominguez]

Hi

how can I know the RTT in QUIC?  How can I calculate looking into a wireshark trace?

Is it going to provide wireshark as TCP does with TCP stream graphs tool?

Regards,

Rodrigo