wireshark tutorial how do i know the swich packages

So that point onwards all your data frames (not management frames, null frames) are encrypted using CCMP/AES. Once 4 way handshake is completed, both client & AP having required key for data encryption. Now if you analyze this you would see “ 4-way handshake ( EAPOL-Messages 1 to 4)” messages exchanged after Open Authentication phase finished ( Auth Request, Auth Response, Association Request, Association Response). Here is my packet capture ( WPA2-PSK-Final) You can open this in wireshark to test this out by yourself. Once you do this you can open wireshark application & select the interface named “ mon0” for wireless packet capturing.

If airodump-ng, aireplay-ng or airtun-ng stops working afterĪ short period of time, you may want to kill (some of) them! Retry long limit:7 RTS thr:off Fragment thr:offįound 1 processes that could cause trouble. Mode:Managed Frequency:5.18 GHz Access Point: Not-Associated RX bytes:0 (0.0 B) TX bytes:0 (0.0 iwconfig wlan2 channel iwconfig Wlan2 Link encap:Ethernet HWaddr 00:20:a6:ca:6b:b4 RX bytes:4665 (4.6 KB) TX bytes:4665 (4.6 ifconfig wlan2 up ifconfig TX packets:66 errors:0 dropped:0 overruns:0 carrier:0 RX packets:66 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 ifconfigĮth0 Link encap:Ethernet HWaddr 00:21:9b:62:d0:4a It is just simple 2-3 line configuration required to set up a USB adapter as monitor interface for wireshark. I have used BackTrack with USB adapter to take this packet capture ( Refer this youtube video for how to do it). Simply what you have to do is take a “wireless packet capture” on CH 36 as my AP operate in that channel.

I am using 5GHz & therefore get 802.11a summary here (If you want sniff 2.4GHz, then you can issue command with 802.11b) (4402-3) > show ap config 802.11a summaryĪP Name SubBand RadioMAC Status Channel PwLvl SlotId Otherwise you can simply use application like InSSIDer to see which channel given SSID is operating. Since my AP is managed by WLC 4400, I can simply get that info from CLI. This is useful when you study (my case for CWSP studies) different security protocols used in wireless.Here is the basic topology for this post.īefore start capturing you should know which channel your AP is operating. In this post we will see how to decrypt WPA2-PSK traffic using wireshark.

Wireshark tutorial how do i know the swich packages