I need to sniff HTTP traffic on WPA2 network at home. I am running wireshark 1.8.2 on debian linux. I have TPLink TL-WN722N usb wireless adaptor on this machine. I have put this adaptor in monitor mode and also specified WPA2 password in preferences. I captured packets on mon0 interface. It does not show any HTTP packets. I am not sure whether it was able to decrypt packets successfully. The protocol column in wireshark shows mostly 802.11. How can I get it to capture and show HTTP packets? asked 23 Dec '12, 12:48  nash_rack1 |
One Answer:
With WPA2, the client negotiates a new key each time it connects to the access point. The WPA2 password is only used to securely establish the session key. For WPA2 decryption to work in wireshark, you will need to capture the 4 authentication packets at the beginning of the connection to the AP. So, disconnect from the SSID, start capturing packets in wireshark, connect to the SSID and you should be able to see the IP (decrypted) traffic. answered 23 Dec '12, 13:54  SYN-bit ♦♦ |
Your suggestion worked great. Now I can see decrypted traffic. Thanks a lot!
@nash_rack1 If an answer solves your problem, please accept it by clicking the checkmark icon by the answer for the benefit of other users who may have the same question.