This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello

I heard that Wireshark does support decoding WPA. Does Wireshark decode WPA-traffic in realtime?

Thank you very much!

Joe

asked 14 Jan '16, 09:56

joseph123's gravatar image

joseph123
119912
accept rate: 0%

What do you mean by "in real time"?

(14 Jan '16, 18:54) Guy Harris ♦♦

If in realtime means while Wireshark is capturing data, then the answer is yes, as long as Wireshark is able to see the 4 EAPOL frames, see the Wiki.

https://wiki.wireshark.org/HowToDecrypt802.11

If in realtime means output on the CLI while tshark is capturing, then please see my answer to the following question:

https://ask.wireshark.org/questions/24249/decrypt-wpa-with-tshark

If you substitute -nr input.pcap with -ni interface (while 'interface' is a placeholder for the wifi interface name), you will get the decrypted WPA output at the CLI.

If in realtime means something different, please tell us what it means to you.

Regards
Kurt

permanent link

answered 19 Jan '16, 08:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×89
×23

question asked: 14 Jan '16, 09:56

question was seen: 1,273 times

last updated: 19 Jan '16, 08:03

p​o​w​e​r​e​d by O​S​Q​A