Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I understand it correctly (after reading the question below) that's because I have to capture session keys when other users start their sessions. So my question is how do I capture and use session keys to decrypt traffic in the capture file? I know I can force clients to deauthenticate but somehow I guess I have to extract the session keys and use them in e.g. Wireshark.

Any advantage to securing WiFi with a PSK, other than to keep out unauthorized

share|improve this question
add comment

1 Answer

In Wireshark, filter for "eapol" packets. You can read RFC 4764 to figure out how to derive the encryption key from those packets, or look at the Wireshark decryption source code.

They say this exchange pattern is for the sake of simplicity, though I consider not using a Diffie-Helman exchange to have been foolish (see section 1.1.1).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.