Decrypt 802.11w (PMF) Managment packet

asked 2020-02-09 21:51:45 +0000

Yedivach
3 ●1 ●4

updated 2020-02-09 21:53:08 +0000

Hi, Does Wireshark supports decrypt (802.11) managment packets (as part of PMF connection)? If yes, there is a special way to do so? Because I have tried just to insert the keys and it doesnt work (unicast managment should use the same key as the data)

Thanks

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2020-02-09 22:56:52 +0000

Chuckc
2858 ●5 ●569 ●19

Yes.
https://bugs.wireshark.org/bugzilla/s...
I was able to decode the test data using the keys provided:
https://code.wireshark.org/review/#/c...
Nice description of MFP: https://documentation.meraki.com/MR/W...

edit flag offensive delete link

Comments

Need Association and EAPOL packets: https://wiki.wireshark.org/HowToDecry...

Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic.

The wiki doesn't mention needing the Association Request but I find the decrypt does not work without it.

Chuckc ( 2020-02-09 23:26:31 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-02-09 21:51:45 +0000

Seen: 1,513 times

Last updated: Feb 09 '20

Decrypt 802.11w (PMF) Managment packet edit