Capturing Traffic in Linuxįirst, let’s capture some traffic (note, you may need to change “wlan1” to “wlan0” or whatever your adapter shows up as. Note: In theory, this should work with WPA and WEP encrypted traffic as well, with only slight modification for WEP. Cool side note: This might even work across pcaps if the files are opened in the right order! For example, if you capture a handshake in cap1.pcap, and more traffic (but no handshake) in cap2.pcap, you can open cap1.pcap first, then File > Open cap2.pcap, and the handshake from cap1.pcap will be used to decrypt traffic in cap2.pcap.You can only unencrypt traffic for devices for which you also captured a four-way handshake which occurred after the handshake took place.You must have the WPA2 password and SSID.There are several components that must all work together in order to be successful: Here’s a condensed version of what I learned. After several hours of struggling, I was able to do it.

Set the display filter to “ip” to filter out all of the wireless noise.Īnalyzing WPA2 encrypted wireless traffic is more difficult than I thought it would be. Wireshark will refresh the display with decrypted traffic.

Enter the key in the following format: password:ssid.

Edit > Preferences > Protocols > IEEE 802.11 > Decryption Keys > Edit > New (+).

How to crack key pcap wireshark