How do I decrypt WPA2 encrypted packets using Wireshark?

Posted by Rox on Super User See other posts from Super User or by Rox
Published on 2012-03-20T21:05:08Z Indexed on 2012/03/20 23:33 UTC
Read the original article Hit count: 335

Filed under:

wireless-networking

|

wireshark

|

wpa2-psk

|

decrypt

I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail with my own packets).

I caught the four-way handshake from another client connecting to the network.

My network info is as follows:

SSID: test
Passphrase: mypass
The above info would give this preshared key: 58af7d7ce2e11faeab2278a5ef45de4944385f319b52a5b2d82389faedd3f9bf

In Wireshark in the Preferences-->IEEE 802.11 I have set this line as Key 1:

wpa-psk:58af7d7ce2e11faeab2278a5ef45de4944385f319b52a5b2d82389faedd3f9bf

I have tried the different options of "Ignore the protection bit" but none works.

What could I have missed?

© Super User or respective owner

Related posts about wireless-networking

Wireless Networking for a Small Business at Home

as seen on Internet.com - Search for 'Internet.com'
Cisco's designed its latest wireless networking router for the home, which could work nicely for home-based entrepreneurs looking for a simplified way to cut the Ethernet cord. >>> More
ZigBee, Wi-Fi Team Up for Wireless Networking

as seen on Dr Dobbs - Search for 'Dr Dobbs'
Goal is interoperable wireless technology in smart homes ZigBee - Wireless - Data Communications - Business - Telecommunications >>> More
Wireless Networking 802.11n

as seen on Article City - Search for 'Article City'
It';s been years in development but this September it looks like 802.11n Wi-Fi will finally become a standard... well, an official standard anyway. Presently the majority of the wireless hardware you... [Author: Chris Holgate - Computers and Internet - April 08, 2010] >>> More
Wireless Networking Advice for Small Business

as seen on Internet.com - Search for 'Internet.com'
Our resident Wi-Fi expert answers questions and offers his take on wireless networks for home and small business. This month: Linksys router firmware and public hotspot configuration. >>> More
Wireless Networking Advice for Small Business

as seen on Internet.com - Search for 'Internet.com'
Our resident Wi-Fi expert answers questions and offers his take on wireless networks for home and small business. This month: Linksys router firmware and public hotspot configuration. >>> More

Related posts about wireshark

wireshark http POST

as seen on Server Fault - Search for 'Server Fault'
Hi I would like to have a http POST request method CAPTURE filter I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible I wrote tcp dst port 80 and (tcp[13] = 0x18) But it is not perfect... tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) 2):4] =… >>> More
How to filter http traffic in Wireshark?

as seen on Server Fault - Search for 'Server Fault'
I suspect my server has a huge load of http requests from its clients. I want to measure the volume of http traffic. How can I do it with Wireshark? Or probably there is an alternative solution using another tool? This is how a single http request/response traffic looks in Wireshark. The ping is… >>> More
Multi language support in wireshark

as seen on Super User - Search for 'Super User'
Do we have multiple language support with Wireshark. We are using Windows Xp SP2 and Ubuntu Linux environment. Actually we have a plugin which is UDP based and we have a requirement to Analyse the Information in Packet List Pane and Packet Details Pane to be viewed in other languages like French… >>> More
Wireshark is not capturing traffic through http://localhost:8888

as seen on Super User - Search for 'Super User'
Currently, my wireshark can capture traffic from http://localhost (traffic that is on port 80) but it won't capture traffic on localhost:8888 Is there any extra configuration/software that I need for wireshark to capture traffic of localhost on this port? I'm running Ubuntu 9.10 >>> More
Saving Wireshark capture settings for future use

as seen on Server Fault - Search for 'Server Fault'
Is there any way to save Wireshark capture options? So it can be reuse after restart Wireshark. Also, if the saved file is in plain text, it's possible to use scripts generating bunch of capture settings, such with different filter setting. Does anyone know? Thanks. >>> More