On Sat, Nov 22, 2008 at 09:52:48PM -0500, LI, Feng wrote:
>
> I have notice wireshark can decode WEP 802.11 packets by setting the IEEE
> 802.11 protocol preferences (Edit->Preferences->IEEE 802.11)
> http://wiki.wireshark.org/HowToDecrypt802.11
>
> Is there any option or switch for tshark (cmd line version) to decode WEP
> packets ?
Yes, you can. You can see all the current preferences with
tshark -G currentprefs | grep wlan
The preferences are shared between Wireshark and Tshark, so you can set
preferences in Wireshark first and then use Tshark.
Or you can edit the preferences file in a text editor before starting Tshark.
Or you can use command line options to set preferences like this:
tshark -o "wlan.enable_decryption: TRUE" -o "wlan.wep_key1: wpa-pwd:1f2e3d4c5b:myssid -i wifi etc...
Hope this helps,
Cheers,
Sake
