Bob Jones's profile - activity

If you use a debug version of Wireshark, I see that the MICs do not match for the value in EAPOL key2 in the failing cas

Seems Wireshark does not know about the AKM (display filter: frame.number == 3389): ** (wireshark:24764) 07:36:48.90397

Seems Wireshark does not know about the AKM (display filter: frame.number == 3389): ** (wireshark:24764) 07:36:48.90397

To clarify, you have the actual airpcap hardware? What indicates to you that it is successfully installed?

You have some hosts that do not seem to behave very nicely with arp - it indicates you have duplicate IP: Frame 721: 62

Key Data in message 3 is encrypted. From your screenshot, you only show Message 3, where as you would need all four EAP

With the updated configuration information, this is a common issue of captue setup. The source of the data to the print

then the conversation "disappears" I could only see something like this happening if you had specific filters that requ

>>then the conversation "disappears" I could only see something like this happening if you had specific filters t

then the conversation "disappears" I could only see something like this happening if you had specific filter

For chasing loss like this I usually start with ip.id field and compare at source and destination. Does not always work

Looking at the specs for that capture device, it is an RTL 8811AU and is 11ac/1SS/SGI (from the vendors' wireless perfor

Some ARP and a snippet of IGMP, looks like Both are typically normal on networks.

Reviewing the capture filter syntax, I don't think there is anything to specifically get frames at this level of detail

Why do you need a silent install? Is there a reason you have to capture locally on the box? Capture external to the bo

This has an example: https://ask.wireshark.org/question/28766/tshark-how-to-decode-80211-capture-with-temporal-key/

How, exactly, do you have this setup? Are you doing something like this: https://www.intuitibits.com/2021/03/08/capturi

There are instructions to configure capture for non-elevated users: https://wiki.wireshark.org/CaptureSetup/CapturePrivi

What type of traffic do you have captured - is it 802.11/monitor mode? If so, there are other fields that may contain d

What type of traffic do you have captured - is it 802.11/monitor mode? If so, there are other fields that may contain d

That adapter generally works, either in managed or monitor mode. Did you setup capture permissions properly? https://w

Did you read the comments at the bottom of the tshark.dev page? They describe the same situation that you are in.

I don't think there is support for what you want - save a decrypted wireless trace as pcap/pcapng. For TLS, hooks exist

There is no radiotap or PPI header here - how are you capturing the monitor mode frames?

I think you want to match up the BSSID field from the eapol frames to another frame type that contains the SSID name. I

I think you want to match up the BSSID field from the eapol frames to another frame type that contains the SSID name. I

You should create a new post - no one will see this except for those of us who worked on this one before. You will want

Sometimes, yes.

Look at the source IP in the screenshot - it is 192.168.0.1 as the sender of the TCP reset to close the connection.

that the problem is likely originating from the Mettler Toledo IND570 Funny how the one vendor blames the other as if

You need access Request access, or switch to an account with access. Learn more Can you make publicly available?

You need access Request access, or switch to an account with access. Learn more Can you make publicly available?

Is there a Wireshark question here? Wireshark might help you diagnose the issue but you would have to first collect a m

I am not sure Wireshark is the best tool for this. Some options: Specific tool for this, like lansweeper and probably

I am not sure Wireshark is the best tool for this. Some options: Specific tool for this, like lansweeper and probably

The github site for your driver says this: Recommendation: Do not buy adapters based on this chipset. You will be disa

Assuming this is an issue with decryption, but you could have other issues since you are using an RTL chipset in monitor