Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to compare against a user's handshake?

For example, if I had a 4-way Handshake could I check a protected frame to see if it matches my handshake without actually using the handshake to decrypt the frame?

share|improve this question
do you want to see if a captured, encrypted frame belongs to a handshake you captured? usually, in an encrypted frame, there is the header which contains information like source and destination, which would probably enough for you to match messages with a handshake, as long as there was no new handshake that you may have missed. if i am way off, please clarify what you need ;) – user1451340 May 6 '13 at 8:54
thanks for your response user145, yea that is pretty much what I am looking to do. I think the value would be in the encrypted portion of the frame :( Atleast that is what I have seen in my research – pyRabbit May 16 '13 at 17:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.