Skip to main content
Information Security

Return to Answer

Corrected spelling, fixed grammer
Source Link
edit approved May 23, 2019 at 5:16
Community Bot
edit approved May 23, 2019 at 5:16
Community Bot
  • 1

InWith WPA Networks everyeach connection is encrypted with a uniqunique key. The PSK is only there for authentificationauthentication and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSKPSK; you also need doto capture the 4-Way-Handshake of everyone connected to be ablein order to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad, your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passivlypassively sniffing the traffic. So it very often happens that you miss some part of or a whole conversation due to uncorrectlyincorrectly received packets. You need a good antenna and a good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.

In WPA Networks every connection is encrypted with a uniq key. The PSK is only there for authentification and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSK you also need do capture the 4-Way-Handshake of everyone connected to be able to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passivly sniffing the traffic. So it very often happens that you miss some part or a whole conversation due to uncorrectly received packets. You need a good antenna and a good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.

With WPA Networks each connection is encrypted with a unique key. The PSK is only there for authentication and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSK; you also need to capture the 4-Way-Handshake of everyone connected in order to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad, your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passively sniffing the traffic. So it very often happens that you miss some part of or a whole conversation due to incorrectly received packets. You need a good antenna and good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.

Source Link
davidb
davidb
  • 4.3k
  • 3
  • 23
  • 33

In WPA Networks every connection is encrypted with a uniq key. The PSK is only there for authentification and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSK you also need do capture the 4-Way-Handshake of everyone connected to be able to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passivly sniffing the traffic. So it very often happens that you miss some part or a whole conversation due to uncorrectly received packets. You need a good antenna and a good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.