To decrypt 802.11 header in Wireshark, you must know the WPA password.

Now, for example, there is a network which when clicked takes you to a login page where every user on the network has a username and a password. So, it's an open network but redirects you to a page with a login screen.

If I decrypt the 802.11 packets with wireshark with my username and password, can I see all the other packets, like other people that are browsing without knowing their username and password? Like, instead of seeing "protocol:802.11", can I see "http,tcp"? Even though it's all on the same network but everyone has their own password? If, what i am saying is wrong, is there a way to decrypt 802.11 headers without knowing the WPA password?

I am not sure how much sense it made but if some part does'nt make sense, please ask.

closed as too broad by JakeGould, robinCTS, Twisty Impersonator, bertieb, music2myear Jul 25 '18 at 15:28

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Web-based login pages do not affect 802.11 in any way. It's just a website. Yes, it controls the router's firewall to let you through, but it cannot enable encryption at 802.11 level.

If it's a fully open network, then there's no encryption at 802.11 level at all – you'll see plain TCP/IP. (But you probably won't see passwords, as any self-respecting site uses TLS (HTTPS). And TLS is not encrypted with your username nor password.)

If the network uses either WPA or WPA2 in WPA-Personal (WPA-PSK) mode, you can decrypt another client's 802.11 frames if you've captured its initial handshake with the wireless access point. (WPA3 will prevent this.)

If the network uses WPA-Enterprise (WPA-EAP) mode, you cannot generally decrypt anyone else's 802.11 traffic, as they have individual keys issued by the EAP server.

  • So,if it is in WPA-PSK mode then all i need is the handshake. I mean, i don't need the individuals password to decrypt the data once he has logged in to the network? Like, if i get the handshake and he is logged in to the network, i get to see the higher protocols like http,tcp – john Jul 18 '18 at 16:58
  • The captive portal site is unencrypted, it's http. But before they login in, they do not have any protocol or anything. But, why does'nt people logging in to the network show up on wireshark? – john Jul 18 '18 at 17:01
  • Uh, why do you say "they don't have any protocol or anything"? Sure they do. The captive portal is a website. By the time you reach it, you're fully connected to the network. You've associated to the AP, obtained an IP address, you're speaking TCP to a webserver. – grawity Jul 18 '18 at 18:02
  • There could be a few reasons why you don't see those packets, maybe the WiFi adapter's "monitor mode" is not working as it should, maybe your device only understands 802.11n and that other client is using .11ac, maybe it's out of range. But none of them are related to the fact that it's a captive portal. – grawity Jul 18 '18 at 18:04
  • So if i have a 802.11n and i got a device on the same network with a 802.11g, i can't capture the "802.11\g" traffic on the network? – john Jul 18 '18 at 22:17

Networks that redirect you to a login page when you open a web page (like in Firefox or Chrome) do not use WPA or any kind of encryption whatsoever.

This uses what is known as a "captive gateway". It does not restrict connection to the WiFi network itself, and does not interact with how data transits on the WiFi network. It only allows or prevents you from accessing the Internet through this gateway.

You can sniff the WiFi data to your heart's content, since it is not encrypted at the 802.11 level. However, if the user uses another method to encrypt their data (including HTTPS or VPN), then you can't decrypt that.

Oh, and unless the captive gateway has been poorly designed, you can't get other users's passwords since it would use HTTPS.

The combination of WPA and login+password is known as WPA Enterprise. With this type of security you need to enter your login & password before connecting to the network, i.e. when you select it in your list of networks. Only a very small number of networks use this, the most famous one being Eduroam, which allows university students & staff to access the Internet from almost any university in the world.

In a network like this every user's WPA encryption key will be unique and you will only be able to sniff your own traffic.

  • In this case, the author is using a network using a captive portal that does use a username and password. Which means it could use encryption (as opposed to those captive portals that connect you to an open unencrypted network). Of course, WPA has numerous exploits, WPA2 exists to correct those issues, although WPA3 should be used going forward. Hotels typically offer an encrypted wireless connection, which can be accessed, if you know your last name and room number – Ramhound Jul 18 '18 at 15:27
  • 2
    @Ramhound: But the captive portal is not related in any way to the WiFi-level encryption. You could have an open network with username/password captive portal. You could have a WPA2-PSK network with an "open" captive portal. You could have a wired connection with a captive portal. – grawity Jul 18 '18 at 15:30
  • @grawity - I didn't say it was, but a captive portal where you simply "agree" to terms, does not typically result in a secure network (encryption) but an insecure open network. – Ramhound Jul 18 '18 at 15:31
  • So the answer's author is correct for a large amount of captive-portal networks, though shouldn't claim that all of them "do not work this way". – grawity Jul 18 '18 at 15:33
  • 2
    @Ramhound I am not sure of what you mean. What I meant by "no network encryption" was that there is no station <--> access point encrypted channel created at the WiFi level. That is, if the stations themselves do not use encryption towards their target (such as HTTPS, SSH et al.) their taffic is up for grabs. The presence or absence of a login/password in the captive portal does not change anything. – Nathan.Eilisha Shiraini Jul 18 '18 at 15:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.