hi, I captured a wireless transaction of WPA2-PSK, in which 4way handshake of EAPOL packets happened. I saved the capture and analysing in 2 different versions of wireshark. In the image attachedalt text, packet # 119 is the 4th message of EAPOL handshake. In v1.12.2, it shows the 'message 4 of 4'. Same capture file when I opened in v1.12.10, it shows 'message 2 of 4'. Please tell which one is correct. Thanks in advance. --uv.! asked 29 Mar '16, 05:54  ubuntuv |
One Answer:
From the screenshot that you provided, it appears that Wireshark v1.12.2 is showing the correct information. It would be best to view the entire capture file to confirm (or at least the Association Request, Association Response and the EAPOL 4-way handshake frames). I am making this assumption based on the IEEE specification, sections 11.6.6.3 and 11.6.6.5 which define the value for the WPA Key Nonce as following:
As your screenshot shows, the Key Nonce is a non-zero value indicating a Message 2. However, there are other parameters that can be used to verify (e.g., Replay Counter). answered 29 Mar '16, 11:31  Amato_C |
Ok. Can someone confirm if this is a bug in wireshark. I need this for my work. Thanks in advance.
--uv.
It is hard to get a better than the one that Amato gave you. But please read this bug report https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11994