I’m trying to use AirPCap (Classic) with WireShark Version 1.12.5 (v1.12.5-0-g5819e5b from master-1.12) 64 bit on Win7 64 bit with WinPCap 4.1.3 to capture packets on a 2.4GHz Wireless-G network (Channel 6) encrypted with a known WPA-PSK key. The problem is that I’m seeing hardly any data packets (just control and management packets) even though the two devices I’m interested in are clearly exchanging lots of data. Neither device is the capture PC (a recent vintage HP laptop running on AC power.) I’m using for following settings although I’ve tried others with no luck
The capture was started with a Nexus 9 tablet with Wifi disabled and then it was enabled to ensure that the capture includes the EAPOL packets. Display filter: “eapol” clearly include the four EAPOL packets exchanged between device Htc_07:bc:f9 (The Nexus 9 tablet) and Netgear_bd_e8:6a (The Netgear router acting as the AP) However, filtering with “ip” shows only 3 bogus (corrupted) packets. Using filter “wlan.addr == b4:ce:f6:07:bc:f9” (the MAC address of the Nexus 9) show a bunch of IEEE 802.11 control packets and a few encrypted IP Multicast packets but they are not decrypted using the WPA key. Using a capture filter such as “wlan host b4:ce:f6:07:bc:f9” does not help either. What am I doing wrong? asked 04 Jun '15, 10:43 Gengen converted 04 Jun '15, 11:05 Guy Harris ♦♦ |
Does the capture filter "type data" work?
Can you put a sample capture on a network drive so I can look at the capture (such as Google Drive or Cloudshark)?