This is our old Q&A Site. Please post any new questions and answers at

From this wiki page:

WPA and WPA2 use keys derived from an EAPOL handshake to encrypt
traffic. Unless *all four* handshake packets are present for the
session you're trying to decrypt, Wireshark won't be able to
decrypt the traffic. You can use the display filter eapol to
locate EAPOL packets in your capture.

I've noticed that it works with (1,2,4) too. Can someone please explain this?

Test case

This is the gzipped handshake (1, 2, 4) and an ecrypted ARP packet (SSID: SSID, password: password) in base64 encoding:


Decode with:

$ base64 -d | gunzip > handshake.cap

Run tshark to see if it correctly decrypt the ARP packet:

$ tshark -r handshake.cap -o wlan.enable_decryption:TRUE -o wlan.wep_key1:wpa-pwd:password:SSID

It should print:

  1   0.000000 D-Link_a7:8e:b4 -> HonHaiPr_22:09:b0 EAPOL Key
  2   0.006997 HonHaiPr_22:09:b0 -> D-Link_a7:8e:b4 EAPOL Key
  3   0.038137 HonHaiPr_22:09:b0 -> D-Link_a7:8e:b4 EAPOL Key
  4   0.376050 ZyxelCom_68:3a:e4 -> HonHaiPr_22:09:b0 ARP is at 00:a0:c5:68:3a:e4

asked 12 Oct '11, 15:39

cYrus's gravatar image

accept rate: 0%

edited 18 Apr '12, 02:07

Not sure if I got that right - so please comment on every guess here: afaik eapol msgs 1 and 2 are the most important ones because Anonce and Snonce are readable in there, so you can check if the given PSK is correct by calculating PTK out of A/Snonce. EAPOL msg 3 from what I remember was for supplying GTK, so this might affect decoding broadcast only, but like mentioned JUST guessing here...

(19 Apr '12, 05:55) Landi

AFAIK you're right, the question is: "How does Wireshark really perform decryption?".

(27 Apr '12, 04:37) cYrus

I guess that comes to "read the f%$!ing code" :D at least that's what I assume comes next for understanding how wireshark decodes the stuff

@devs: any info?

(28 Apr '12, 05:16) Landi

Yep, I guess that's the one... :/ I've sent a message in the mailing list, still no answers.

(28 Apr '12, 14:43) cYrus
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 12 Oct '11, 15:39

question was seen: 19,422 times

last updated: 28 Apr '12, 14:43

p​o​w​e​r​e​d by O​S​Q​A