Tshark -i wlan0 -owg.keylog_file:wg.keys -f 'udp port 51820' To filter WireGuard traffic while capturing, you can use: Screenshot (with decryption keys configured): Ī complete list of WireGuard display filter fields can be found in the display filter reference. The test suite contains two capture samples: Key log filename (wg.keylog_file): The path to the file which contains a list of secrets (see Key Log Format) Dissect transport data (wg.dissect_packet): Whether the IP dissector should dissect decrypted transport data.WireGuard static keys (wg.keys): A table of long-term static keys to enable WireGuard peer identification or partial decryption WireGuard dissection and decryption support was added in Wireshark 3.0 ( Bug 15011).Īs of Wireshark 3.2, decryption secrets can be embedded in a pcapng file ( Bug 15571). There is no standard port and typically WireGuard is detected through heuristics. UDP: WireGuard uses UDP as its transport protocol. Support for other platforms (macOS, Android, iOS, BSD, and Windows) is provided by a cross-platform wireguard-go implementation. As of January 2020, it has been accepted for Linux v5.6. Donenfield in 2015 as a Linux kernel module. WireGuard was initially started by Jason A.

Wireshark capture filter reference