Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have put wireshark to capture interface in monitor mode. I have also enable decryption and set keys in Wireshark preferences, but protocol for all packets is 802.11 which I think it means that packets are not decrypted.

I search for this problem and found out wireshark should also capture EAPOL packets exchanged between AP and devices before it can decrypt packets, and this exchange occurs when a device joins to a AP.

So I disconnected my mobile phone from wifi network and connected again. Then wireshark began to view TCP and other packets. That was ok, but after I powered off AP and turned it on again wireshark again doesn't do decryption.

I searched for EAPOL packets but there was no result. I disconnected and connected my phone again but no success.

Now, My question is If EAPOL packets are exchanged after a device joins to AP why there is no result for EAPOL filter in wireshark even after connect/disconnect?

share|improve this question
Have you seen wiki.wireshark.org/CaptureSetup/WLAN, especially the preferences about the part about Protection bit (No, Yes - with(out) IV)? –  Lekensteyn Nov 20 '13 at 16:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.