Ask Your Question

Revision history [back]

How to decrypt WPA with tshark

I'm using this command:

tshark -r Sniffer.pcap -w sniffer_decrypted.pcap -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\"passphrase\""

If I don't specify an output file then what is written to the console looks right. But specifying an output file creates a file which is identical to the input file (i.e. decryption not done).

What am I doing wrong?

Using tshark 4.2.2