Wireshark · Wireshark-users: Re: [Wireshark-users] Questions about the latest release

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Thomas Nyheim wrote:
> Firstly, how does the WPA decryption work?

If all of the following conditions are true:

  - You're using pre-shared keys
  - All 4 RSNA handshake packets are present for the session you're
    trying to decrypt
  - You've specified the proper password, password+SSID, or raw PSK

then Wireshark can determine the derived key for a WPA session and
decrypt its traffic.