Wireshark-users: Re: [Wireshark-users] 802.11 monitoring help
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Thu, 18 Feb 2010 12:30:02 -0800
Thomas Morton wrote:
> I was under the impression using airpcap was an optional extra on
> WIndows - but that Wireshark could decrypt packets (the userguide
> suggests this). I will have a re-read.

That's correct. 802.11 decryption should work no matter what on any
platform provided:

  - You've captured the 4-way EAPOL handshake necessary to derive the
    keys (try filtering for "eapol").

  - You've toggled the "Assume Packets Have FCS" and "Ignore the
    Protection bit" appropriately for the way your driver delivers
    802.11 frames

  - You're using pre-shared keys.

  - You have a recent version of Wireshark. Various decryption bugs
    have cropped up in older versions.

-- 
Join us for Sharkfest ’10! · Wireshark® Developer and User Conference
Stanford University, June 14-17 · http://www.cacetech.com/sharkfest.10/