I am not able to get EAPOL packets on Wireshark. I've provided my AP's PSK decryption key to protocol 802.11 and adjusted my monitor mode interface's(TP-Link WN722N) frequency channel correctly. I got only 802.11 and LLC frames and not able to see any HTTP, TCP and EAPOL pdu although I have all traffic types multicast/unicast/broadcast, up to MCS7 for 802.11bgn.

Is my potential problem only decryption of frames or a frequency mismatch? Are there any required configuration to get EAPOL packets?

  • And you are definitely using EAPOL on your network, yes? – Rory Alsop Jan 15 '17 at 21:03
  • No, I don't know how to determine it. – Berat Postalcioglu Jan 15 '17 at 21:13
  • So, do you use RADIUS to authenticate devices? – Rory Alsop Jan 15 '17 at 21:25
  • No, I don't use RADIUS authentication – Berat Postalcioglu Jan 15 '17 at 21:27
  • have u detect and use the correct channel? WIFI have many different channel, and you will need 14 different adaptor to collect all the different channel concurrently: osqa-ask.wireshark.org/questions/62565/…. The proper sequence is authen + probe + association request and response packet, to be followed by the 4 way handshake, which is EAPOL setting up the encrypted channel. – Peter Teoh May 30 '18 at 4:37

I figured out the problem by rebooting my AP during Wireshark capture session. After doing that Wireshark could capture EAPOL packets, then decryption worked as well. However, I cannot capture all packets in the WLAN traffic and don't know why.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.