Wireshark only frees used associations when editing keys or when it's closed. with 'wlan.addr') and saving into a new file should get decryption working in all cases. Filtering out only the relevant packets (e.g. Nevertheless decoding can still fail if there are too many associations. Newer Wireshark versions are able to handle up to 256 associations and should be able to decode any packets all the time. Therefore, when several devices have attached to the network while the trace was running, the packet overview shows all packets decoded, but in the detailed packet view, only packets of the last device that activated ciphering are properly deciphered. Older versions of Wireshark may only be able to use the most recently calculated session key to decrypt all packets. WPA and WPA2 use individual keys for each device.

You will need to do this for all machines whose traffic you want to see. One way to do this is to put the machine to sleep (for smartphones and tablets, 'turning off' the machine puts it to sleep) before you start the capture, start the capture, and then wake the machine up. In order to capture the handshake for a machine, you will need to force the machine to (re-)join the network while the capture is in progress. You can use the display filter eapol to locate EAPOL packets in your capture. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic. WPA and WPA2 use keys derived from an EAPOL handshake, which occurs when a machine joins a Wi-Fi network, to encrypt traffic. It's like when you take an appointment to your doctor because you're sick, and before you can get there you are already healed ! I should have been more careful. And, by the way, I am more likely to use tshark than Wireshark, so command lines are welcome.

Then, either it is the wifi adapter fault (is it possible ?) or the way I proceed to filter my packets.Įvery suggestion is appreciated. Thus, I am sure that Wireshark is able to decrypt and that I do the right thing. Is this behaviour normal ? However, I am able to decrypt the traffic from the pcap file of this tutorial. My first thought was that, since I sniff a whole channel, packets may not be decrypted correctly, and Wireshark would think it is better not to apply decryption.

Of course I followed the wiki steps ( ), tried with wpa-psk and wpa-pwd, without success. But I am struggling with the decryption part. Then, if I can sniff every packet on the channel (if possible with wlan capture filter to get rid off packets which do not belong to my network) and decrypt them on the fly, it would do the trick. Solution 2 - Monitor mode : My wifi adapters can be switched to monitor mode (scan everything on the channel). Obviously, everything directed from/to is captured. For instance, when starting a Wireshark/ tshark capture, I am not able to sniff packets from/to different IP than mine (except broadcast). As far as I understand, this is called promiscuous mode, but it does not seem to work with my adapter (internal wifi card or external dongle). Solution 1 - Promiscuous mode : I want to sniff only one network at a time, and since it is my own, the ideal solution would be to be connected to the network but capture every packet even if directed to some other IP. Project : Sniff packets from my local network to identify DNS queries, store them in a plain database with host IP, timestamp and URL as attributes. Here is what I want to do, and the solutions I considered.

Wireshark monitor mode 802.11