This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Decrypting WPA2/ IEEE 802.11 with use of AirPcap classic USB adapter

0

Hello,

I am using Ethereal/Wireshark for years. I wanted to enhance my mobility when it comes to the capturing WiFi with use of AirPcap classic USB adapter (http://www.airpcap.nl/airpcap-classic.htm):

  1. I am using WPA2 encryption
  2. I am using NetGear WNDAP30 (http://www.netgear.com/business/products/wireless/business-wireless/wndap350.aspx)
  3. I have set correct channel
  4. I have seen EAPOL packets captured
  5. I have entered WPA-PWD password and SSID correctly
  6. Sample capture from Wireshark wiki works for me (https://wiki.wireshark.org/HowToDecrypt802.11)
  7. I was experimenting with "Assume Packets have FCS" and "Ignore the protection bit"
  8. I spend ~5 hours trying to decrypt the communication - none positive result..., but I am not expert on IEEE 802.11
  9. My Wireshark version is: Version 1.10.0 (SVN Rev 49790 from /trunk-1.10)

Any idea what I m doing wrong? Thanks a lot STeN

asked 17 Sep '15, 22:57

stenlik's gravatar image

stenlik
6●1●1●3
accept rate: 100%

  1. Did you read the Wireshark Wiki at: https://wiki.wireshark.org/HowToDecrypt802.11

  2. Were you able to capture all 4 EAPOL packets between the client and the AP?

  3. Did you enter the correct SSID and passphrase using the procedure described in the following question: https://ask.wireshark.org/questions/45881/cant-decrypt-80211-traffic

  4. Are you able to post a sample capture on cloudshark or Google Drive?

(18 Sep '15, 06:14) Amato_C

One Answer:

0

Hello, I have double checked everything and I did not changed anything except I reset AP and notebook and now it starts working… I have no explanation for that :( However thanks for trying to help me! Regards, Petr

answered 19 Sep '15, 01:14

stenlik's gravatar image

stenlik
6●1●1●3
accept rate: 100%

I reset AP and notebook

That may have forced an EAPOL handshake to be transmitted. On a WPA or WPA2 network, you need more than just the password, you need the EAPOL handshake.

(19 Sep '15, 14:52) Guy Harris ♦♦