# What is the process for deciphering network frames with Suricata?

**URL:** <https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838>\
**Category:** Help\
**Tags:** ips\
**Created:** [September 4, 2024, 12:32pm UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838 "2024-09-04T12:32:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![a\_m](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/a_m/32/3305_2.png) [@a\_m](https://forum.suricata.io/u/a_m)\
**Post date:** [September 4, 2024, 12:32pm UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838/1 "2024-09-04T12:32:02Z")

</div>

> Please include the following information with your help request:
> 
> - Suricata version 8.0.0-dev
> - Operating system and/or Linux distribution ubuntu 23.10
> - How you installed Suricata (from source, packages, something else)  
> from repo github

do i must use `sskey.log` ,with the environment variable added: export `SSLKEYLOGFILE="/home/alexandre/sslkey.log"` in file `~/. bashrc?` as for wireshark ? and how

and for the frames of the systems , is what I have to use the certificates in `/etc/ssl/certs`? I also have a file in `/etc/ssl/private`

regards

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 4, 2024, 12:34pm UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838/2 "2024-09-04T12:34:54Z")

</div>

I think you’re asking if Suricata can decrypt files and then inspect the unencrypted contents. No, Suricata will not perform this function.

---

<div class="post-metadata">

**Author:** ![a\_m](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/a_m/32/3305_2.png) [@a\_m](https://forum.suricata.io/u/a_m)\
**Post date:** [September 4, 2024, 1:18pm UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838/3 "2024-09-04T13:18:15Z")

</div>

Is it possible to add this feature in this situation?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 4, 2024, 1:29pm UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838/4 "2024-09-04T13:29:22Z")

</div>

Anything’s possible but it’d start with a redmine ticket.

---

<div class="post-metadata">

**Author:** ![a\_m](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/a_m/32/3305_2.png) [@a\_m](https://forum.suricata.io/u/a_m)\
**Post date:** [September 5, 2024, 7:59pm UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838/5 "2024-09-05T19:59:55Z")

</div>

Hello,  
what is redmine ticket ?  
Regards

---

<div class="post-metadata">

**Author:** ![satta](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/satta/32/18_2.png) [@satta](https://forum.suricata.io/u/satta)\
**Post date:** [September 6, 2024, 7:06am UTC](https://forum.suricata.io/t/what-is-the-process-for-deciphering-network-frames-with-suricata/4838/6 "2024-09-06T07:06:15Z")

</div>

Opening a feature request ticket here: [https://redmine.openinfosecfoundation.org/](https://redmine.openinfosecfoundation.org/)