This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

cannot decrypt WPA2-PSK

0

Hi all,

I'm running 1.12.2 and trying to decrypt 802.11 WPA2 Personal. Under IEEE 802.11 protocol of Edit -> Preferences, I chosen the Key type as wpa-psk, input the Key (generated here https://www.wireshark.org/tools/wpa-psk.html) and check marked the "Enable decryption" checkbox. After clicking Apply, I still see Data shown under IEEE 802.11 Data field of the Packet Details pane, cannot see any IP or upper later header. The data was not decrypted. Am I missing something?

thank you!

asked 17 May '15, 22:13

SteveZhou's gravatar image

SteveZhou
191273034
accept rate: 0%


One Answer:

0

Some ideas:

  • Do you see the 4 EAPOL frames in the capture file? If no, then you can't decrypt the frames (see: https://wiki.wireshark.org/HowToDecrypt802.11 ).
  • Try to use "wpa-pwd" (Passphrase) instead "wpa-psk" and the online generated key

Additionally, please read my answer to the following question:

https://ask.wireshark.org/questions/29592/decrypting-a-80211-packets-on-wpa2-psk

Regards
Kurt

answered 17 May '15, 22:32

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

I hit idea-1. Thanks a lot!

(19 May '15, 00:51) SteveZhou