# How to decrypt SSH messages in Wireshark

**URL:** <https://erlangforums.com/t/how-to-decrypt-ssh-messages-in-wireshark/2672>\
**Category:** Questions / Help\
**Tags:** erlang-otp, ssh\
**Created:** [June 7, 2023, 5:04pm UTC](https://erlangforums.com/t/how-to-decrypt-ssh-messages-in-wireshark/2672 "2023-06-07T17:04:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhuvan](https://erlangforums.com/letter_avatar_proxy/v4/letter/b/f4b2a3/32.png) [@bhuvan](https://erlangforums.com/u/bhuvan)\
**Post date:** [June 7, 2023, 5:04pm UTC](https://erlangforums.com/t/how-to-decrypt-ssh-messages-in-wireshark/2672/1 "2023-06-07T17:04:12Z")

</div>

I have written an Erlang application to send data over SSH to a server. The Erlang application acts as client in my setup. The client uses OTP `ssh` module. It uses various ssh functions such as `ssh:connect, ssh_connection:session_channel & ssh_connection:send`.

In order to debug an issue, I am using Wireshark application to check the packets exchanged between the client and server.

I see packets in Wireshark for all steps performed by the client. Most of these packets are encrypted by SSHV2.

In order to decrypt, I need to specify the required file in Wireshark, which contains private key, etc. Where can I find the private key?

I tried to find the details using available `ssh` function such as `ssh:connection_info`. But, I could find the private key.

```erlang
(node1@vm-alarm)6> ssh:connection_info(Client).
[{client_version,{{2,0},"SSH-2.0-Erlang/4.15.3"}},
 {server_version,{{2,0},"SSH-2.0-Erlang/4.9.1.3"}},
 {peer,{"10.0.2.15",{{10,0,2,15},2022}}},
 {user,"admin"},
 {sockname,{{10,0,2,15},35022}},
 {options,[{password,not_ok},
           {pref_public_key_algs,['ecdsa-sha2-nistp384',
                                  'ecdsa-sha2-nistp521','ecdsa-sha2-nistp256','ssh-ed25519',
                                  'ssh-ed448','rsa-sha2-256','rsa-sha2-512']},
           {user,"admin"}]},
 {algorithms,[{kex,'ecdh-sha2-nistp256'},
              {hkey,'ssh-ed25519'},
              {send_mac,'chacha20-poly1305@openssh.com'},
              {recv_mac,'chacha20-poly1305@openssh.com'},
              {encrypt,'chacha20-poly1305@openssh.com'},
              {decrypt,'chacha20-poly1305@openssh.com'},
              {compress,none},
              {decompress,none},
              {send_ext_info,false},
              {recv_ext_info,true}]},
 {channels,[[{type,"session"},
             {sys,"none"},
             {user,<0.90.0>},
             {flow_control,undefined},
             {local_id,0},
             {recv_window_size,425984},
             {recv_window_pending,0},
             {recv_packet_size,65536},
             {recv_close,false},
             {remote_id,0},
             {send_window_size,655360},
             {send_packet_size,65536},
             {sent_close,false},
             {send_buf,{[],[]}}]]}]

```

---

<div class="post-metadata">

**Author:** ![mmin](https://erlangforums.com/user_avatar/erlangforums.com/mmin/32/2193_2.png) [@mmin](https://erlangforums.com/u/mmin)\
**Post date:** [June 7, 2023, 7:41pm UTC](https://erlangforums.com/t/how-to-decrypt-ssh-messages-in-wireshark/2672/2 "2023-06-07T19:41:40Z")

</div>

SSH looks for “~/.ssh/id\_\<alogrithm\>” (at least on UNIX), e.g. “~/.ssh/id\_rsa” usually contains private key for `ssh` using `rsa` encryption and that is what you’re probably looking for. You can read more about SSH configuration here [here](https://www.erlang.org/doc/man/ssh_app#configuration).