Wireshark-dev: [Wireshark-dev] Have problem where one capture with EAPOL decrypts OK but anothe
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Tue, 7 Nov 2017 03:58:08 -0800
Hi folks,

I have a pair of captures with EAPOL, each with four key exchanges.

In the first, when I enter the appropriate WPS-PWD info, one decrypts
OK, the other doesn't.

The only interesting thing I can see for the one that doesn't decrypt
is that one of key exchanges is a retransmit.

Has anyone seen this?

Also, where is the key info assembled in the dissector? I have not yet
understood where in the code this is being done.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)