 | 1 | initial version |
I would suggest searching for the device via its MAC address instead of ip. Ip requires decryption to be successful while the Mac will show in any case. Use something like wlan.addr == <mac>
First see if you can find the device at all, and you need data or qos-data frames to contain the IP address. It could be you are not getting all 4 eapol frames; maybe device is connected on a different channel than you expect. It’s also possible that the modulation is higher than what the monitor supports but doubt that is the case here.
What do you see when you look for that MAC address?
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
