NmDecrypt is a Decryption Expert for Network Monitor 3.3.

A user can run the Expert on their capture file and provide a certificate and passkey in order to generate a new capture file with decrypted frames in the trace, much like regular reassembly.

This Expert requires that you have Network Monitor 3.3 with the 3.4.2131 parser set (or above) installed. The latest parser set is available at http://nmparsers.codeplex.com/.

Supported SSL/TLS Versions

SSL 2.0
SSL 3.0
TLS 1.0
TLS 1.1

Note: For the above SSL/TLS versions the Expert does not support scenarios which involve Client Authentication and Decryption of Encrypted Alert Messages.

Supported Cipher Suites

TLSRSAWITHAES128CBCSHA
TLSRSAWITHAES256CBCSHA
TLSRSAWITHRC4128_SHA
TLSRSAWITH3DESEDECBCSHA
TLSRSAWITHRC4128_MD5
SSLCKRC4128WITH_MD5
SSLCKDES192EDE3CBCWITH_MD5
TLSRSAWITHNULLMD5
TLSRSAWITHNULLSHA