We're now a non-profit! Support open source packet analysis by making a donation.

Wireshark-users: Re: [Wireshark-users] Viewing TKIP-encrypted data

From: "Frank Bulk" <frnkblk@xxxxxxxxx>
Date: Thu, 12 Apr 2007 09:31:21 -0500

Did you get a chance to review this page?


-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of David
Sent: Thursday, April 12, 2007 3:16 AM
To: Community support list for Wireshark
Subject: [Wireshark-users] Viewing TKIP-encrypted data


A question about what I should be expecting to see when monitoring a  
WPA-PSK encoded wireless network.  I have the passphrase set in the  
IEEE 802.11 preferences, with the option set to decrypt encrypted  
data.  But all the data frames I see are just that: data, with  
nothing recognisable within them.  What should I expect to see if the  
passphrase is set correctly?

And a curious point - when I look at the unfiltered packets, it is a  
collection of IEEE 802.11 and LLC protocols.  When I apply a filter  
to view an individual MAC address (using wlan.addr==<00...>) all the  
LLC packets are then reported as IEEE 802.11 packets.  Is this expected?



Wireshark-users mailing list