Cannot decrypt POST requests in monitor mode [closed]

asked 2019-04-10 05:47:32 +0000

dizcza gravatar image

updated 2019-04-12 08:31:58 +0000

Hello, wireshark community. I put Alfa adapter in monitor mode and ran airodump-ng wlan0mon -w out --essid <SSID name> --channel 13. Then I opened this file via wireshark, entered the valid wpa-pwd decryption key for the specified SSID and filter packets to display http only.

I hit, which is http only, and entered some username and password. Clicked submit and back to wireshark. I see only http GET requests to, but I'm unable to see the post request that I sent no matter how many times I tried.

Updated 1

I noticed that instead of POST request I see TCP ACKed unseen segment warning. But I don't understand why it didn't capture this packet. Wireshark FAQ explains that it might be due to my interface was not fast enough but why it is able to capture all GET requests then?

Updated 2

The issue turned out to be not persistent while I thought it was.

edit retag flag offensive reopen merge delete

Closed for the following reason not a real question by dizcza
close date 2019-04-12 08:29:21.372522


Do you see the same problem when capturing with Wireshark on the default interface, not in monitor-mode?

Ross Jacobs gravatar imageRoss Jacobs ( 2019-04-10 11:21:06 +0000 )edit

I can see POST requests in wireshark through the same interface in managed mode.

dizcza gravatar imagedizcza ( 2019-04-10 11:45:24 +0000 )edit

Are you capturing and communicating on the same interface, at the same time?

Bob Jones gravatar imageBob Jones ( 2019-04-10 12:19:24 +0000 )edit

@Bob, No while in monitor mode and yes in managed mode.

dizcza gravatar imagedizcza ( 2019-04-10 14:16:11 +0000 )edit

Making the capture file available would speed up analysis but it may contain sensitive information. If this is a consistent problem - not just a single frame missing - I would suspect it's a capture issue. For whatever reason the modulation used to send the particular frame you are looking for can't be picked up. Frame 8187 is an ACK but I don't see a data frame. I don't know what filter you might have in place, nor all the MACs and IP mappings to help deduce if this is part of the missing exchange. Then we might need a 2nd capture system to see if this frame is picked up there; maybe try a Macbook or a different capture adapter. Without the capture I can't tell at what modulations/signal strengths are in play to know what may have happened here. But also your problem statement ...(more)

Bob Jones gravatar imageBob Jones ( 2019-04-11 12:14:12 +0000 )edit