Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2024-08-26 11:48:59 +0000

Bob Jones gravatar image

Seems Wireshark does not know about the AKM (display filter: frame.number == 3389):

** (wireshark:24764) 07:36:48.903972 [(none) WARNING] C:\bld\workspace\ATT_Git_wireshark_master\binaries_1\wireshark_src\epan\crypt\dot11decrypt.c:2376 -- Dot11DecryptGetKckLen(): Unknown akm

The AKM in use here is (see RSN Information): Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) SAE (GROUP-DEPEND) Auth Key Management (AKM) Suite: 00:0f:ac (Ieee 802.11) SAE (GROUP-DEPEND) Auth Key Management (AKM) OUI: 00:0f:ac (Ieee 802.11) Auth Key Management (AKM) type: SAE (GROUP-DEPEND) (24)

Per 802.11-2020 Table 9-151—AKM suite selectors, values 21-255 are Reserved. But AKM:24 is defined in the WPA3 document from WiFi-Alliance (https://www.wi-fi.org/system/files/WPA3%20Specification%20v3.3.pdf). Per latest source code in gitlab, Wireshark only interprets up to AKM:18.

I didn't see an open enhancement request for this in gitlab, so maybe file one? https://gitlab.com/wireshark/wireshark/-/issues

Seems Wireshark does not know about the AKM (display filter: frame.number == 3389):

** (wireshark:24764) 07:36:48.903972 [(none) WARNING] C:\bld\workspace\ATT_Git_wireshark_master\binaries_1\wireshark_src\epan\crypt\dot11decrypt.c:2376 -- Dot11DecryptGetKckLen(): Unknown akm

The AKM in use here is 24 (see RSN Information): Information):

Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) SAE (GROUP-DEPEND)
    Auth Key Management (AKM) Suite: 00:0f:ac (Ieee 802.11) SAE (GROUP-DEPEND)
        Auth Key Management (AKM) OUI: 00:0f:ac (Ieee 802.11)
        Auth Key Management (AKM) type: SAE (GROUP-DEPEND) (24)
(24)

Per 802.11-2020 Table 9-151—AKM suite selectors, values 21-255 are Reserved. Reserved. But AKM:24 is defined in the WPA3 document from WiFi-Alliance (https://www.wi-fi.org/system/files/WPA3%20Specification%20v3.3.pdf). Per latest source code in gitlab, Wireshark only interprets up to AKM:18.

I didn't see an open enhancement request for this in gitlab, so maybe file one? https://gitlab.com/wireshark/wireshark/-/issues