Which version of WS supports WPA2 decryption?

asked Nov 7 '17

This post is a wiki. Anyone with karma >750 is welcome to improve it.

Hi I have WS Version 2.2.6 (v2.2.6-0-g32dac6a) x64 , I have provided the password and SSID in WS -> Perferences in IEEE 802.11 with respect to the instructions in the following article https://wiki.wireshark.org/HowToDecry... there is quote in the article such as

"If your preferences window doesn't mention WPA, like this dot11-wep-only.png then your version of Wireshark only supports WEP decryption. This might be the case with older versions of Wireshark, particularly the 64-bit Windows version.

Is it true that I'm using the rong version of WS or am I doing something wrong here with supplying the keys? I followed the exact notation e.g. Password[:SSID]

I 'd like to know also which exact vesion of WS supports WPA2 decryption.

add a comment

2 Answers

Sort by » oldest newest most voted

answered Nov 7 '17

Guy Harris
19905 ●3 ●667 ●207

That Wireshark Wiki page is rather out-of-date; it describes the UI of the old GTK+ version of Wireshark, not the UI of the new Qt version.

All Qt versions of Wireshark support WPA2 decryption. The very first commit for WPA/WPA2 decryption was back in 2006, so that support was probably present in Wireshark 1.0.

link

add a comment

answered Nov 7 '17

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23850 ●4 ●988 ●227 https://www.wireshark.org

Note that not only do you have to supply the key in the correct format, you also have to capture the session setup handshake (EAPOL) as noted in the "Gotchas" section on the Wiki page.

Unfortunately the Wiki page you reference is somewhat out of date. WPA2 decryption is supported by all recent versions. If running on Windows or macOS then you should update to the stable 2.4.x version. If using Linux you may be stuck with whatever your distribution provides.

link

add a comment