Decryption Expert Error

Jan 26, 2012 at 12:48 PM

Hi,

I am using Network Monitor 3.4 with NmDecrypt 2.3 to decrypt an SSL frame. After setting the certificate path I get the following error message:

---------------------------Decryption Expert: Error---------------------------Decryption failed, While Initializing Netmon APIs Parser Engine---------------------------OK   ---------------------------

The error log contains this:

-.-.-.-.-.-.- SSL Decryption Log -.-.-.-.-.-.-
Log Created On: 1/26/2012 8:44:38 AM
There was an error loading the NMAPI. Please ensure you have the correct version installed for your platform.Cleanup Failed.  No API Found
-.-.-.-.-.-.- SSL Decryption Log Ends-.-.-.-.-.-.-

 

Any suggestions would be greatly appreciated. Thanks.

Robert

Coordinator
Jan 26, 2012 at 1:40 PM

It seems that the expert can't load the API at all.  I assume you can open the trace in the UI and see TLS or SSL frames?  What platform are you running on x86 or x64?

Thanks,

Paul

Jan 26, 2012 at 2:01 PM

Yes, I can see the TLS (1.0) frames. THe sysytem is a Windows Vista Enterprise SP2 64. Thanks for your help.

Coordinator
Jan 26, 2012 at 2:36 PM

It seems unlikely as I thought the installer checked, but is it possible you have x86 version of the expert installed?  Are there any stray NMAPI.DLL files that the expert might be accessing?

Jan 26, 2012 at 3:26 PM

The Network Monitor download was NM34_x64.exe and the Decryption Expert download was NetmonDecryptionExpert_x64.msi. They both look like the x64 versions. Its the first time I install these 2 files so I don't know if there are any other NMAPI.DLL files. I'll do a search.

Coordinator
Jan 26, 2012 at 8:32 PM

Very strange.  What if you try the topusers expert, does that work for you?

Jan 27, 2012 at 11:22 AM

Top Users worked although it complained that I was missing the MsChart controls for .Net FW.

Jan 27, 2012 at 11:27 AM

Actually, after downloading the MsChart controls, I tried the decryption expert and it worked. Weird but true. Thanks anyway for your help.

Coordinator
Jan 27, 2012 at 1:19 PM

Well, I agree that makes no sense, but I'm glad it's working.

Aug 2, 2013 at 12:11 AM
I ran into this issue too. The problem for me was that the NMAPI.dll was not in my System PATH Environment variable. Adding C:\Program Files\Microsoft Network Monitor 3 to my PATH Environment variable resolved this error.
Mar 27, 2014 at 4:23 PM
when i am trying to use nmdecrypt i get following erro


-.-.-.-.-.-.- SSL Decryption Log -.-.-.-.-.-.-

Log Created On: 3/27/2014 9:45:49 PM

NMDecrypt Version: 2.3.4.0
NMAPIs Initialized.
Initializing Netmon Parsers...
sparser.npb:001.000 Successfully unserialized NPL parser 'C:\ProgramData\Microsoft\Network Monitor 3\NPL\NetworkMonitor Parsers\Profiles\FE3524BB-D1B3-41a4-BA6B-B05C3056B4D7\sparser.npb.
Netmon Parsers initialized successfully.
Adding SSLVersionSelector Display Filter...
Display Filter added successfully
Adding (Conversation.ProcessName == "OUTLOOK.EXE" Conversation Filter...
Warning: Using a non TCP Conversation Filter, (Conversation.ProcessName == "OUTLOOK.EXE", might cause the expert to fail. You should use a filter at the TCP layer or higher. A conversation filter at a higher level might work, say IPv4 or IPv6, but this depends on the traffic. Under these conditions all traffic must use the same certificate and the traffic for each conversation must be sequential.
ERROR: A value is expected before '&'.
ERROR: Unrecognized or unexpected token ';'.
ERROR: Unrecognized or unexpected token ';'.
ERROR: Value expected after ';'.
ERROR: Token ')' expected after ';'.
ERROR: Unrecognized function or variable 'quot'.
ERROR: Unrecognized function or variable 'OUTLOOK'.
ERROR: Unrecognized function or variable 'quot'.
Error occurred while adding Conversation filter (Conversation.ProcessName == "OUTLOOK.EXE"
SSL Version Filter added successfully
Adding (Conversation.ProcessName == "OUTLOOK.EXE" Conversation Filter...
Warning: Using a non TCP Conversation Filter, (Conversation.ProcessName == "OUTLOOK.EXE", might cause the expert to fail. You must use a filter at the TCP layer or higher. A conversation filter at a higher level might work, say IPv4 or IPv6, but this depends on the traffic. Under these conditions all traffic must use the same certificate and the traffic for each conversation must be sequential.
ERROR: A value is expected before '&'.
ERROR: Unrecognized or unexpected token ';'.
ERROR: Unrecognized or unexpected token ';'.
ERROR: Value expected after ';'.
ERROR: Token ')' expected after ';'.
ERROR: Unrecognized function or variable 'quot'.
ERROR: Unrecognized function or variable 'OUTLOOK'.
ERROR: Unrecognized function or variable 'quot'.
Error occurred while adding Conversation filter (Conversation.ProcessName == "OUTLOOK.EXE"
This Netmon Version is supported
*Warning: We've tested with version: 03.04.2748.0001. Your version is: 3.4.2350.0 000000000. This might cause problems if the TLS/SSL parsers have changed significantly.
Opening Encrypted Capture File: C:\Client-OL 2013\Client-OL 2013.cap
Creating Decrypted Capture File: C:\Client-OL 2013\de.cap
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter
Error occured in retrieving the state of the Conversation Filter

Any idea...
Coordinator
Apr 30, 2014 at 1:29 PM
Seems like you clicked on a process in the conversation tree which added a string and this messed up the command line interface. Can you try first by clicking on a TCP node in the Conversation tree?

Thanks,

Paul