How to Decrypt 802.11
Wireshark
can decrypt WEP and WPA/WPA2 in pre-shared (or personal) mode. WPA/WPA2
enterprise mode decryption is not yet supported.
You can add decryption keys using Wireshark's 802.11 preferences or by using the wireless toolbar. Up to 64 keys are supported.
Adding Keys: 802.11 Preferences
Go to Edit->Preferences->IEEE 802.11. You should see a window that looks like this:
Note
that the key examples mention WPA, and that each key item is labeled
"Key". If your preferences window doesn't mention WPA, like this
then
your version of Wireshark only supports WEP decryption. This might be
the case with older versions of Wireshark, particularly the 64-bit
Windows version.
In all versions WEP keys can be specified as a string of hexadecimal numbers, with or without colons:
a1:b2:c3:d4:e5
0102030405060708090a0b0c0d
In versions that support WPA decryption you should use a prefix to tell Wireshark what kind of key you're using:
- wep The key is parsed as a WEP key.
wep:a1:b2:c3:d4:e5
- wpa-pwd The password and SSID are used to create a raw pre-shared key.
wpa-pwd:MyPassword:MySSID
- wpa-psk The key is parsed as a raw pre-shared key.
wpa-psk:0102030405060708091011...6061626364