David:
Did you get a chance to review this page?
http://wiki.wireshark.org/HowToDecrypt802.11?highlight=%28CategoryHowTo%29
Frank
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of David
Schweinsberg
Sent: Thursday, April 12, 2007 3:16 AM
To: Community support list for Wireshark
Subject: [Wireshark-users] Viewing TKIP-encrypted data
Hi
A question about what I should be expecting to see when monitoring a
WPA-PSK encoded wireless network. I have the passphrase set in the
IEEE 802.11 preferences, with the option set to decrypt encrypted
data. But all the data frames I see are just that: data, with
nothing recognisable within them. What should I expect to see if the
passphrase is set correctly?
And a curious point - when I look at the unfiltered packets, it is a
collection of IEEE 802.11 and LLC protocols. When I apply a filter
to view an individual MAC address (using wlan.addr==<00...>) all the
LLC packets are then reported as IEEE 802.11 packets. Is this expected?
Regards,
David
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
