Let’s start with wpa-psw, the key is in plaintext, the password goes first followed by “:” and the name of the SSID, as shown in the image.ĥ. Enable decryption and click on Edit, as shown in the image:Ĥ. Go to the Wireshark tab > Preferences > Protocols > IEEE 802.11, as shown in the image:ģ. Let’s take a look at frame 28, see the payload is encrypted.Ģ. (I filtered only interesting traffic for this post)įrom packets 9 – 12 we can see the 4-way handshake required, packets 18, 20, 22, and so on shows encrypted Data.

In this post, we are going to focus only on WPA2-PWD & WPA2-PSK. Wireshark is a powerful tool that can decrypt 802.11 frames using the corresponding password from a specific SSID.

In other words, if your capture doesn’t contain the complete handshake, Wireshark won’t be able to decrypt the frames, it won’t work using control frames, management frames, and data frames only.

The packets capture collected must contain the 4-way handshake (EAPOL-Messages 1 to 4), the Wireshark decrypt tool uses WPA/WPA2 keys derived from an EAPOL handshake.Previous packets capture collected in monitor mode.A computer running any OS like Linux, MacOS, or Windows.

Wireshark capture packets from wep