On my WPA2 network, I have been successfully able to get intercept a full four-message EAPOL handshake from a particular computer on my network. It is my understanding that with this handshake (and knowing the passphrase for my network), I should be able to decrypt not only broadcast traffic, but also internet traffic from that computer whose handshake I captured, since its communication with the access point is encrypted using data exchanged in the handshake and the PMK (computed from the SSID and passphrase data).
However, I still seem to only be decrypting "broadcast" traffic. There is no TCP traffic from the computer whose handshake I captured even though I visited unencrypted HTTP sites on it and used netcat on it to communicate with another computer on the WLAN. I can tell that at least the broadcast data is correctly decrypted because I can look at the encrypted and decrypted hex codes for those packets (they happen to primarily be MDNS, ICMP, ARP, etc.). I even tried to take the data and decrypt it with airdecap-ng but this did not work either.
It seems that based on examples of packet data I've been able to play with in Wireshark that I should be able to get this traffic. In particular, this guide shows how to do it and provides a pcap file on which you can easily decrypt the WPA2 packets and get a bunch of TCP packets in Wireshark. Similarly, the Wireshark Wiki explains how to do this in addition to providing pcap samples that also can be decrypted to yield TCP traffic.
- Kali Linux Live Persistence on USB
- Alfa AWUS036H in monitor mode (using airmon-ng)
- WLAN with WPA2, no WPS
- Wireshark IEEE 802.11 Preferences:
- Enable decryption IS checked
- Ignore the Protection bit is set to No
- Decryption keys include a wpa2-pwd entry in the format of passphrase:ssid
Why am I not able to pick up the TCP traffic from the computer for which I intercepted a full EAPOL handshake from, the way that I was able to do so in the sample pcap files I have linked? Am I fundamentally misunderstanding how this works, or is this likely the result of a hardware or network related issue?