With Airodump I can see Wi-Fi networks and clients associated to them. I know password to this Wi-Fi networks. Is it possible to dump encrypted traffic between AP and client (WPA2) and then decrypt it with password to see unencrypted traffic?


If you are able to sniff your traffic in Wireshark:

Edit --> Preferences --> Protocols --> IEEE 802.11 --> Decrypt --> Enter hexadecimal key.

  • I know how to decrypt but I don't know that way, thanks. I'm using Airdecap. I asked about technical capabilities to sniff all network traffic between AP and client. Is it possible?
    – QkiZ
    Mar 4 '16 at 21:48
  • I see, if you aren't performing this from on the client itself, I am not sure. Sorry!
    – 404Cat
    Mar 5 '16 at 17:28
  • I sniff some traffic to pcap file. But after decrypt via Airdecap I got file 24 bytes long and nothing in there.
    – QkiZ
    Mar 5 '16 at 17:42

First, use Airodump-ng's --output-format to capture in pcap format.

The, use tshark, per Decrypt WPA with Tshark on ask.wireshark.org, or wireshark itself as 404Cat listed.

tshark -nr input.pcap -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -R "http"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.