Wireshark can't decrypt WPA2 LAN traffic

Question

I want to decrypt my own network traffic.

I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter.

Open Wireshark, start capture in promiscuous mode & monitor mode and I receive all the packages around me.

The problem is that I cant decrypt it.

I added in Preferences -> Protocols -> IEEE 802.11 Decryption keys :

• pwd in format pass:ESSID
• PSK generated from pass + salt from Wireshark website

I found a lot of comments on this subject, tried everything out there :

• play with "ignore protection bit" and "assume packets have FCS"
• restarted Wireshark
• connect a device to LAN after the capture has peen started so the handshake can be captured.

What can I do ?

EDIT :

I updated Wireshark to last stable version for Linux and still doesn't work.

Answer 1

OK, let's start with the basics, to decrypt the traffic you need the PTK (Pairwise transient key) which is dynamically generated every connection (hence you need to capture the 4-way handshake) and is derived from the PMK (or PSK) which is generated by the PBKDF2 and has two inputs (It has more but are hardcoded) that you already have.

For Wireshark to decrypt the traffic it needs the capture the four way handshake (From here it takes the ANounce, SNounce and MIC to verify if the PTK matches the conversation) and provide the PMK.

To provide the PMK just add the passphase to the 802.11 key list in Edit->Preferences->IEEE 802.11 with the right syntax

wpa-pwd:passphrase:SSID
OR
wpa-pwd:passphrase

The SSID is optional, Wireshark can get it from the handshake when it sees it.

IF YOU USE wpa-psk: you need to manually compute the PMK (PSK) with the PBKDF2 function and write the output (256-bit key) after it, like this:

wpa-psk:47389...30413

Here's the guide from the wiki. Maybe you're just missing the wpa-pwd: in the key field.

• pwd in format pass:ESSID

FINAL SOLUTION

In Wireshark select the channel in which the AP in on. (Provided by doremifasolasido)