Ask Your Question
0

Decrypt 802.11w (PMF) Managment packet

asked 2020-02-09 21:51:45 +0000

Yedivach gravatar image

updated 2020-02-09 21:53:08 +0000

Hi, Does Wireshark supports decrypt (802.11) managment packets (as part of PMF connection)? If yes, there is a special way to do so? Because I have tried just to insert the keys and it doesnt work (unicast managment should use the same key as the data)

Thanks

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-02-09 22:56:52 +0000

Chuckc gravatar image

Yes.
https://bugs.wireshark.org/bugzilla/s...
I was able to decode the test data using the keys provided:
https://code.wireshark.org/review/#/c...
Nice description of MFP: https://documentation.meraki.com/MR/W...

edit flag offensive delete link more

Comments

Need Association and EAPOL packets: https://wiki.wireshark.org/HowToDecry...

Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic.

The wiki doesn't mention needing the Association Request but I find the decrypt does not work without it.

Chuckc gravatar imageChuckc ( 2020-02-09 23:26:31 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-02-09 21:51:45 +0000

Seen: 1,768 times

Last updated: Feb 09 '20