In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to compare against a user's handshake?

For example, if I had a 4-way Handshake could I check a protected frame to see if it matches my handshake without actually using the handshake to decrypt the frame?

  • 1
    do you want to see if a captured, encrypted frame belongs to a handshake you captured? usually, in an encrypted frame, there is the header which contains information like source and destination, which would probably enough for you to match messages with a handshake, as long as there was no new handshake that you may have missed. if i am way off, please clarify what you need ;) May 6, 2013 at 8:54
  • thanks for your response user145, yea that is pretty much what I am looking to do. I think the value would be in the encrypted portion of the frame :( Atleast that is what I have seen in my research
    – pyRabbit
    May 16, 2013 at 17:28
  • Actually you just need the ANounce, SNounce and MIC; which are in the first two packets on the 4WHS, or if you want your own traffic, you only need the 1st and 3rd packet (the 3rd also contains the MIC), and you generate your own SNounce (2nd packet) since you're also a STAtaion.
    – Azteca
    May 4, 2017 at 22:24

1 Answer 1


Answering the title question, NO.

They MIC is only sent over the 2nd and 3rd frame of the 4WHS and the GTK only in the 3rd frame.

And about comparing anything in the 4WHS to any unencrypted portion of a WPA/2 packet is just like @user1451340 said in the comments, only the origin/destination, but these are common for ANY handshake.

What you can do is get an ARP Packet (These are size fixed so you can know which are ARP) and try to decrypt it with the GTK found on the 3rd frame, and if it works, there you got it. Good luck and I hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .