How to decrypt WPA with tshark

asked 2024-02-16 12:08:20 +0000

Quite68
1 ●1

I'm using this command:

tshark -r Sniffer.pcap -w sniffer_decrypted.pcap -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\"passphrase\""

If I don't specify an output file then what is written to the console looks right. But specifying an output file creates a file which is identical to the input file (i.e. decryption not done).

What am I doing wrong?

Using tshark 4.2.2

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2024-02-17 21:35:03 +0000

johnthacker
111 ●11 ●4

updated 2024-02-17 21:47:17 +0000

If you're happy with "the packets that contain IPv6 or IPv6, as a pcap, starting at the IP layer with Raw IP encapsulation", then do this:

"File -> Strip Headers" Select "IP" from the drop down. Click Ok. Save the resultant file. Done.

You lose the IEEE MAC layer, the common LLC layer, the radio tap information, and anything that isn't IP, e.g. you'll lose the EAPOL packets (might be a feature not bug for you), ARP, rarer stuff like oh AppleTalk ARP, etc. But the IP will be decrypted and easily read in tools besides Wireshark because it uses the Raw IP encapsulation.

edit flag offensive delete link

Comments

From tshark, the command is tshark -U IP -r Sniffer.pcap -w sniffer_ip.pcapng -o wlan:enable_decryption:TRUE -o 'uat:80211_keys:"wpa-pwd"'. If you want pcap instead of pcapng add -F pcap

johnthacker ( 2024-02-17 21:45:46 +0000 )edit

add a comment

answered 2024-02-16 14:12:59 +0000

Bob Jones
1481 ●2 ●171 ●22 Boston, MA

I don't think there is support for what you want - save a decrypted wireless trace as pcap/pcapng. For TLS, hooks exist to store decryption keys within the capture file itself for others to open and decrypt again, but I don't think that is true for 802.11 decryption. I think your options are:

Export to a different format - json/xml/whatever
Use a different tool. I think Omnipeek will do this, and aircrack-ng suite of tools can do some of it as well.
Maybe something here: https://ask.wireshark.org/question/27239/export-pcap-containing-decrypted-traffic/