diff --git a/README.md b/README.md index df3f429..27403aa 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,8 @@ [![Release](https://img.shields.io/github/v/release/dspace-group/dsV2Gshark?label=release)](https://github.com/dspace-group/dsV2Gshark/releases) [![dSPACE](https://img.shields.io/badge/-OpenSource%20powered%20by%20dSPACE-blue)](https://www.dspace.com/) -## ❗Wireshark 4.4+ requires dsV2Gshark 1.4.2 or higher❗ +> [!IMPORTANT] +**Wireshark 4.4+ requires dsV2Gshark 1.4.2 or higher** ## Overview This Wireshark plugin allows to analyze and decode packets between electric vehicles (EV) and charging stations (EVSE), also known as V2G messages. @@ -31,12 +32,14 @@ This Wireshark plugin allows to analyze and decode packets between electric vehi - Wireshark I/O Graph support for V2G packets ### Live TLS Decryption -> To decrypt a TLS session, you need a compatible device (like the dSPACE DS5366) that is capable of disclosing the TLS secret during or after the handshake. Please note that this feature is not available on productive devices. It is not possible to decrypt regular TLS sessions. -> If a session with a disclosed TLS secret was recorded without dsV2Gshark being installed, you can still decrypt the data by installing dsV2Gshark afterwards. +> [!IMPORTANT] +To decrypt a TLS session, you need a compatible device (like the dSPACE DS5366) that is capable of disclosing the TLS secret during or after the handshake. Please note that this feature is not available on productive devices. It is not possible to decrypt regular TLS sessions. +If a session with a disclosed TLS secret was recorded without dsV2Gshark being installed, you can still decrypt the data by installing dsV2Gshark afterwards. The plugin processes a TLS master secret disclosure packet after handshake to decode the following V2G session. The disclosure message is a UDP packet within the source port range 49152-65535 (see Wireshark protocol settings) containing the ASCII string `CLIENT_RANDOM <32-byte client random> <48-byte master secret>` as payload data (TLS 1.2). This disclosure message has to be sent from one of the communication partners in a testing environment. For TLS 1.3 decryption you have to provide different secrets: `CLIENT_HANDSHAKE_TRAFFIC_SECRET`, `SERVER_HANDSHAKE_TRAFFIC_SECRET`, `EXPORTER_SECRET`, `CLIENT_TRAFFIC_SECRET_`, `SERVER_TRAFFIC_SECRET_`. You can send one UDP packet for each secret or combine the secrets in one UDP packet (separated by line breaks). +> [!NOTE] In order to autodecrypt charging sessions using non-GUI versions of Wireshark (e.g. tshark), the full PCAP must be parsed twice. This is because there is no matching redissection trigger available in the Wireshark API. ### Wireshark I/O Graph