3

Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption".

Currently I can only view the following traffic protocols: ICMPv6, ARP, MDNS, IGMPv3, BROWSER, NBNS, DHCP.

I know there are HTTP and HTTPS packets being sent to my router but Wireshark is not showing me these packets.

I am sniffing my wlan0 and I believe I have started my airmon correctly.

Does anyone know why I am unable to sniff HTTP or HTTPS traffic?

Improve this question

1 Answer 1

Reset to default
1

With WPA Networks each connection is encrypted with a unique key. The PSK is only there for authentication and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSK; you also need to capture the 4-Way-Handshake of everyone connected in order to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad, your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passively sniffing the traffic. So it very often happens that you miss some part of or a whole conversation due to incorrectly received packets. You need a good antenna and good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.

Improve this answer
2
  • Thank you for the response. I will give this a try. Optimally if I was simply looking to collect some http packets that were not being sent from my machine I would try this by using an unsecured router that has no encryption?
    – vector
    Commented Oct 5, 2015 at 14:40
  • That will do it too, yes...
    – davidb
    Commented Oct 5, 2015 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .