hello! Recently, I try to capture packets with tshark. I execute asked 25 Sep '13, 09:16  btk913 edited 25 Sep '13, 09:49  grahamb ♦ |
One Answer:
If your network is "protected", meaning it's using WEP or WPA/WPA2, the traffic on it is encrypted and, if you capture in monitor mode, the packets you get will not have been decrypted. You will have to configure TShark to decrypt it; see the Wireshark Wiki "how to decrypt 802.11" page. If you configure Wireshark, you've also configured TShark, as the configuration information is used by both of them. You could also configure that information by editing the Wireshark preferences file, but that's a more complicated process. Other parts of that, such as the requirement to capture the initial EAPOL handshake, also apply, so you may need to disconnect machines from the network and then reconnect them, or put them to sleep and wake them up, to force the handshake to occur. This even applies to the machine running TShark if you want to capture and decrypt its traffic. answered 25 Sep '13, 16:40  Guy Harris ♦♦ |
This is my first time that get right answer from forum. Thank you so much. I will try this tonight. Thanks again!