I have the following settings:

MacBook Pro 2012

macOS 10.12.4

In Wire Shark

Under Capture>Options>Wifi En1 Link-layer Header is set to 802.11; Moniter and promiscuous mode are enabled

Under Wireshark>Protocols>IEEE 802.11>Decryption Keys (I am trying to decrypt a WPA2 Personal)

Keytype: wpa-pwd

Key: password:ssid

I am only seeing protocol 802.11, very few SSDP, very few ICMPv6, very few LLC

I would like to see http protocols from my iPhone next to me.

If I go to a website on my Mac I will see the http but not if I go from my iPhone.

I have atachted a couple images:



Thanks for you help!

  • If you're able to see your Mac's http traffic on your WiFi interface with Wireshark, then I suspect you're not actually in monitor mode, Commented May 15, 2017 at 2:12
  • I was in monitor mode but still connect to wifi. Commented May 16, 2017 at 8:08
  • Wow what I have learned in a bit over a year.... Commented Aug 24, 2018 at 19:23

2 Answers 2


To decrypt WPA-PSK or WPA2-PSK protected traffic, you must capture the eapol-key handshake at the beginning of the connection. So when attempting to capture your own machine's traffic, you must start the capture before you join the network. And even then I'm not sure it would work, as packets generated by the Wi-Fi chipset itself (as oppposed to being generated by the Wi-Fi driver running in the kernel space of macOS) are not passed back up to macOS to be passed to BPF, so sniffers like wireshark never see them.

  • How would I do so? Commented May 16, 2017 at 8:07
  • 1
    @JBis set up a second machine, join it to the network and capture it with wireshark Commented Aug 24, 2018 at 19:17

Instead of attempting to intercept traffic between my iPad and my WiFi router, I created an Internet Connection Sharing WiFi network on my computer, and set the iPad to use the hotspot I'd created. My computer is also connected via Ethernet. Since it's in the middle of the conversation, instead of trying to eavesdrop from the side, it makes examining traffic to and from my iPad much more straight-forward, and didn't require adding any encryption keys to my tcpdump command.

The iPad was assigned an IP Address of, on interface EN1, my Mac's WiFi interface.

I was then able to capture data going to my iPad without having to deal with encryption keys, by capturing traffic to and from on EN1.

I'm using tcpdump, but I believe WireShark's functionality and output is similar...

[nevin-mac-mini:~] root# tcpdump -i en1 -n -s 1500 host
tcpdump: verbose output suppressed, use -v or -vv 
for full protocol decode

listening on en1, link-type EN10MB (Ethernet), capture size 1500 bytes

23:32:02.470713 IP > #.#.#.#.80: 
Flags [P.], seq 1:368, ack 1, win 2058, options
 [nop,nop,TS val 1300636770 ecr 2646279932], 
length 367: HTTP: GET /~nevin/ HTTP/1.1

  • While this would most likely work, the point of this is to use the decryption keys Commented Aug 26, 2018 at 2:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .