Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Can Wireshark/Ethereal decode WEP or WPA data packets ?

April 26, 2017Data decode ethereal packets wep Wireshark wpa

0

10 Posted

Can Wireshark/Ethereal decode WEP or WPA data packets ?

1 Answer

1

Posted

Recent versions of Ethereal and Wireshark can decrypt WEP. Go to Edit → Preferences → Protocols → IEEE 802.11, select 1 in the “WEP key count” and enter your WEP key below. Wireshark 0.99.5 and above can decrypt WPA as well. Go to Edit → Preferences → Protocols → IEEE 802.11, select “Enable decryption”, and fill in the key according to the instructions in the preferences window. You can also select “Decryption Keys…” from the wireless toolbar if it’s displayed. Many times in this forum and on the wiki we suggest using Wireshark to review packets. There are two books which are available specifically for learning how to use Wireshark in detail. The books are are listed here. The good news is that they have made Chapter 6 of the “Wireshark & Ethereal Network Protocol Analyzer Toolkit” covering wireless packets available online in PDF format. Here is the link to Chapter 6. As well, see this section on the Wireshark Wiki.