Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have put wireshark to capture interface in monitor mode. I have also enable decryption and set keys in Wireshark preferences, but protocol for all packets is 802.11 which I think it means that packets are not decrypted.

I search for this problem and found out wireshark should also capture EAPOL packets exchanged between AP and devices before it can decrypt packets, and this exchange occurs when a device joins to a AP.

So I disconnected my mobile phone from wifi network and connected again. Then wireshark began to view TCP and other packets. That was ok, but after I powered off AP and turned it on again wireshark again doesn't do decryption.

I searched for EAPOL packets but there was no result. I disconnected and connected my phone again but no success.

Now, My question is If EAPOL packets are exchanged after a device joins to AP why there is no result for EAPOL filter in wireshark even after connect/disconnect?

share|improve this question
Have you seen, especially the preferences about the part about Protection bit (No, Yes - with(out) IV)? – Lekensteyn Nov 20 '13 at 16:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.