tshark: How to decode 802.11 capture with temporal key

edit

Omnipeek will decrypt 802.11 traffic and export the decrypted packets to a file. I don't think it will accept a tk, though, only WPA2 ssid/passphrase or the WPA2 psk, generated from ssid/passphrase.

The aircrack-ng suite of tools has something to decrypt and save packets to a file, too, but IIRC, it only does dot11 unicast traffic. I don't think this will take a tk, either.

Thanks. But Omnipeek won't help me.

I am working on a self written CLI test automation, which relies on tshark already heavly. I've focused on the tk, because it's the easiest for me: you do not need to capture the 4-way handshake for decryption. I haven't thought about aircrack-ng yet, however I need all wireless packets and not only unicast ones ....

I mean, Wireshark itself is capable of decryption with a tk - but how? :D

Is the problem that you can't get tshark to decrypt with a tk or you can't get the decrypted packets saved to a file?

Both. First I need tshark to decrypt all the according packets using the temporal key and store the whole packet flow incl. the decrypted ones (no need for the unencrypted ones) in a new PCAP file. This file will then then be parsed via tshark again to search for certain wireless frames (e.g. I am looking for a certain protected management frame, like an 802.11 Action frame, which includes a "SA Query"). Without decryption this SA Query can not be "seen".

Decryption works with tshark so I see your issue is capturing the decrypted/decoded output as pcap format for subsequent analysis. Does it have to be pcap format for follow-on analysis? It is convenient to use same tool again, but as a work around, maybe consider json output? The -T json format saves decrypted/decoded values and then use another cli tool such as jq, python, etc., to filter or otherwise manage. Using your example for SA Query, I export some packets:

cat saquery.json | jq '.[]._source.layers | {pkt: .frame."frame.number", dot11type: .wlan."wlan.fc.type_subtype", tk: .wlan."CCMP parameters"."wlan.analysis.tk",mgmt:  ."wlan.mgt"}'
{
  "pkt": "1",
  "dot11type": "13",
  "tk": "1cd10b8f713e85a155c822b518369190",
  "mgmt": {
    "Fixed parameters": {
      "wlan.fixed.category_code": "8",
      "wlan.fixed.action_code": "0",
      "wlan.fixed.transaction_id": "0x0000d43e"
    }
  }
}
{
  "pkt": "2",
  "dot11type": "13",
  "tk": "1cd10b8f713e85a155c822b518369190",
  "mgmt": {
    "Fixed parameters": {
      "wlan.fixed.category_code": "8",
      "wlan.fixed.action_code": "1",
      "wlan.fixed.transaction_id": "0x0000d43e"
    }
  }
}