14

I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail with my own packets).

I caught the four-way handshake from another client connecting to the network.

My network info is as follows:

  • WPA2-PSK Personal with AES encryption
  • SSID: test
  • Passphrase: mypass
  • The above info would give this preshared key: 58af7d7ce2e11faeab2278a5ef45de4944385f319b52a5b2d82389faedd3f9bf

In Wireshark in the Preferences-->IEEE 802.11 I have set this line as Key 1:

wpa-psk:58af7d7ce2e11faeab2278a5ef45de4944385f319b52a5b2d82389faedd3f9bf

I have tried the different options of "Ignore the protection bit" but none works.

What could I have missed?

EDIT
This is a really STRANGE thing! I can now decrypt the packets that are going from/to my other laptop. But the packets that go from/to my iPad are NOT decrypted. Why can not the packets from my iPad be decrypted? It is on the same network.

Improve this question
10
  • 1
    What link-layer header type did you use when capturing the packets?
    – Spiff
    Mar 20, 2012 at 21:31
  • At the risk of asking a dumb question, are you sure the network is configured for pre-shared mode? According to the linked page "WPA/WPA2 enterprise mode decryption is not yet supported".
    – Wayne Johnston
    Mar 21, 2012 at 0:14
  • @Spiff: I assume it is Ethernet because I can capture packets, but they are all decrypted. I will have a look later this day and return here with the answer.
    – Rox
    Mar 21, 2012 at 6:54
  • @WayneJohnston: It is NOT a dumb question. :-) I am using WPA2 Personal with AES so it is in pre-shared mode.
    – Rox
    Mar 21, 2012 at 6:58
  • 4
    @Rox are you sure you're viewing raw HTTP packets, and not stuff sent over HTTPS? Also, can you decrypt the packets using aircrack-ng? IIRC, you should be able to use the packets obtained with Wireshark (as opposed to using airmon-ng again).
    – Breakthrough
    May 6, 2012 at 14:47

2 Answers 2

Reset to default
3

WPA uses a nonce (random number used just for this session) to provide freshness (so the same key isn't used every time). Unlike WEP, the messages for different hosts are encrypted using a different key. Your iPad is using a completely different key from your laptop to en/decrypt the packets (these keys are generated from the permanent master key and other info each time you connect to the network). See this wikipedia article for further details and as a starting point.

Improve this answer
1

You need to specifically capture the EAPOL handshake of the session you want to decrypt. You cannot capture the handshake of one device and then decrypt the traffic of another device. So my guess is that when you can decrypt traffic from your laptop but not from the iPad then Wireshark only captured the fourway handshake of the laptop.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .