3

Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption".

Currently I can only view the following traffic protocols: ICMPv6, ARP, MDNS, IGMPv3, BROWSER, NBNS, DHCP.

I know there are HTTP and HTTPS packets being sent to my router but Wireshark is not showing me these packets.

I am sniffing my wlan0 and I believe I have started my airmon correctly.

Does anyone know why I am unable to sniff HTTP or HTTPS traffic?

1

With WPA Networks each connection is encrypted with a unique key. The PSK is only there for authentication and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSK; you also need to capture the 4-Way-Handshake of everyone connected in order to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad, your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passively sniffing the traffic. So it very often happens that you miss some part of or a whole conversation due to incorrectly received packets. You need a good antenna and good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.

  • Thank you for the response. I will give this a try. Optimally if I was simply looking to collect some http packets that were not being sent from my machine I would try this by using an unsecured router that has no encryption? – vector Oct 5 '15 at 14:40
  • That will do it too, yes... – davidb Oct 5 '15 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.