0

I have the following settings:

MacBook Pro 2012

macOS 10.12.4

In Wire Shark

Under Capture>Options>Wifi En1 Link-layer Header is set to 802.11; Moniter and promiscuous mode are enabled

Under Wireshark>Protocols>IEEE 802.11>Decryption Keys (I am trying to decrypt a WPA2 Personal)

Keytype: wpa-pwd

Key: password:ssid

I am only seeing protocol 802.11, very few SSDP, very few ICMPv6, very few LLC

I would like to see http protocols from my iPhone next to me.

If I go to a website on my Mac I will see the http but not if I go from my iPhone.

I have atachted a couple images:

Settings

Wifi

Thanks for you help!

Improve this question
3
  • If you're able to see your Mac's http traffic on your WiFi interface with Wireshark, then I suspect you're not actually in monitor mode,
    – Nevin Williams
    May 15, 2017 at 2:12
  • I was in monitor mode but still connect to wifi.
    – JBis
    May 16, 2017 at 8:08
  • Wow what I have learned in a bit over a year....
    – JBis
    Aug 24, 2018 at 19:23

2 Answers 2

Reset to default
1

To decrypt WPA-PSK or WPA2-PSK protected traffic, you must capture the eapol-key handshake at the beginning of the connection. So when attempting to capture your own machine's traffic, you must start the capture before you join the network. And even then I'm not sure it would work, as packets generated by the Wi-Fi chipset itself (as oppposed to being generated by the Wi-Fi driver running in the kernel space of macOS) are not passed back up to macOS to be passed to BPF, so sniffers like wireshark never see them.

Improve this answer
2
  • How would I do so?
    – JBis
    May 16, 2017 at 8:07
  • 1
    @JBis set up a second machine, join it to the network and capture it with wireshark
    – Nordlys Jeger
    Aug 24, 2018 at 19:17
1

Instead of attempting to intercept traffic between my iPad and my WiFi router, I created an Internet Connection Sharing WiFi network on my computer, and set the iPad to use the hotspot I'd created. My computer is also connected via Ethernet. Since it's in the middle of the conversation, instead of trying to eavesdrop from the side, it makes examining traffic to and from my iPad much more straight-forward, and didn't require adding any encryption keys to my tcpdump command.

The iPad was assigned an IP Address of 192.168.3.3, on interface EN1, my Mac's WiFi interface.

I was then able to capture data going to my iPad without having to deal with encryption keys, by capturing traffic to and from 192.168.3.3 on EN1.

I'm using tcpdump, but I believe WireShark's functionality and output is similar...

[nevin-mac-mini:~] root# tcpdump -i en1 -n -s 1500 host 192.168.3.3
tcpdump: verbose output suppressed, use -v or -vv 
for full protocol decode

listening on en1, link-type EN10MB (Ethernet), capture size 1500 bytes

23:32:02.470713 IP 192.168.3.3.60922 > #.#.#.#.80: 
Flags [P.], seq 1:368, ack 1, win 2058, options
 [nop,nop,TS val 1300636770 ecr 2646279932], 
length 367: HTTP: GET /~nevin/ HTTP/1.1
Improve this answer
1
  • While this would most likely work, the point of this is to use the decryption keys
    – JBis
    Aug 26, 2018 at 2:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.