I followed the following document to operate (by reading the pcap file),
https://docs.zeek.org/en/current/frameworks/tls-decryption.html
but the result was that I was unable to restore the HTTP information in tls. The actual generated conn and http logs were exactly the same as the logs decrypted without keylog.
Then I used the keylog and pcap files provided in the zeek test case, but still couldn’t successfully parse tls. Please help me
Zeek version: 6.2.1
Keylog file: Same as the keylog in \zeek\testing\btest\scripts\policy\protocols\ssl\decryption-keylog.zeek
Pcap file: \zeek\testing\btest\Traces\tls\tls-1.2-stream-keylog.pcap
Operation steps:
export ZEEK_TLS_KEYLOG_FILE=/home/tls/testkeylog.txt
/usr/local/zeek/bin/zeek -C -r tls-1.2-stream-keylog.pcap tls_decryption-1-suspend-processing.zeek
There were no errors after running