This is our old Q&A Site. Please post any new questions and answers at


I heard that Wireshark does support decoding WPA. Does Wireshark decode WPA-traffic in realtime?

Thank you very much!


asked 14 Jan '16, 09:56

joseph123's gravatar image

accept rate: 0%

What do you mean by "in real time"?

(14 Jan '16, 18:54) Guy Harris ♦♦

If in realtime means while Wireshark is capturing data, then the answer is yes, as long as Wireshark is able to see the 4 EAPOL frames, see the Wiki.

If in realtime means output on the CLI while tshark is capturing, then please see my answer to the following question:

If you substitute -nr input.pcap with -ni interface (while 'interface' is a placeholder for the wifi interface name), you will get the decrypted WPA output at the CLI.

If in realtime means something different, please tell us what it means to you.


permanent link

answered 19 Jan '16, 08:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 14 Jan '16, 09:56

question was seen: 1,395 times

last updated: 19 Jan '16, 08:03

p​o​w​e​r​e​d by O​S​Q​A