Wireshark-users: [Wireshark-users] Viewing TKIP-encrypted data

From: David Schweinsberg <david.schweinsberg@xxxxxxxxxxx>
Date: Thu, 12 Apr 2007 18:16:03 +1000

Hi

A question about what I should be expecting to see when monitoring a WPA-PSK encoded wireless network. I have the passphrase set in the IEEE 802.11 preferences, with the option set to decrypt encrypted data. But all the data frames I see are just that: data, with nothing recognisable within them. What should I expect to see if the passphrase is set correctly?

And a curious point - when I look at the unfiltered packets, it is a collection of IEEE 802.11 and LLC protocols. When I apply a filter to view an individual MAC address (using wlan.addr==<00...>) all the LLC packets are then reported as IEEE 802.11 packets. Is this expected?

Regards,

David