Which path allows decrypting the SSL stream if a key is available?

• A. Right click -> Follow SSL Stream
• B. Analyze ->Follow -> TLS Stream
• C. Right click -> Follow UDP Stream
• D. Analyze ->Expert Info

Answer: (A)

The key idea is how to view decrypted TLS data by reconstructing the TLS conversation from the captured packets. If the necessary keys are available, Wireshark can decrypt the TLS stream and present the plaintext by following the TLS/SSL stream. The quickest way is to right-click on a packet that belongs to the TLS conversation and choose the stream-follow option, typically labeled Follow SSL Stream (or Follow TLS Stream in newer versions). This opens a window with the reassembled, decrypted data in the correct sequence, so you can read the application-layer messages. Other options won’t reveal the decrypted TLS payload: following a UDP stream is for UDP traffic, and Expert Info or using the Analyze menu without the stream-follow action won’t reconstruct the TLS conversation. Note that the exact label may vary by version, but the action of following the TLS stream from a TLS packet is the method that exposes the decrypted content when keys are available.