<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">
<channel>
<title>WiFi Edge</title>
<link>http://blog.sudonetworks.com/</link>
<description>802.11 Wireless and Network Security</description>
<language>en-US</language>
<lastBuildDate>Thu, 02 Feb 2012 17:23:42 -0500</lastBuildDate>
<generator>http://www.typepad.com/</generator>

<docs>http://www.rssboard.org/rss-specification</docs>
<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" type="application/rss+xml" href="http://feeds.feedburner.com/sudonetworks/tvhi" /><feedburner:info uri="sudonetworks/tvhi" /><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com/" /><feedburner:emailServiceId>sudonetworks/tvhi</feedburner:emailServiceId><feedburner:feedburnerHostname>http://feedburner.google.com</feedburner:feedburnerHostname><item>
<title>Decrypting WEP with WireShark and AirPcap</title>
<link>http://feedproxy.google.com/~r/sudonetworks/tvhi/~3/0DXEPabiycc/decrypting-wep-with-wireshark-and-airpcap.html</link>
<guid isPermaLink="false">http://blog.sudonetworks.com/2012/02/decrypting-wep-with-wireshark-and-airpcap.html</guid>
<description>Recently I was troubleshooting a WiFi roaming problem at a customer site. At some point I was suspecting an application timeout. In order to verify this on the WiFi side, I had to decrypt the 802.11 WEP packets. WireShark in combination with AirPcap can achieve this for you. It is quite easy to setup. First, I used three AirPcap WiFi adapters to capture traffic on channels 1, 6 and 11. See picture below. Next, from the AirPcap control panel I provided the WEP key for a specific SSID as follows: Then, I launched WireShark and from the Wireless toolbar, I...</description>
<content:encoded><![CDATA[<p> </p>
<p>Recently I was troubleshooting a WiFi roaming problem at a customer site. At some point I was suspecting an application timeout. In order to verify this on the WiFi side, I had to decrypt the 802.11 WEP packets. WireShark in combination with AirPcap can achieve this for you. It is quite easy to setup.</p>
<p>First, I used three AirPcap WiFi adapters to capture traffic on channels 1, 6 and 11. See picture below.</p>
<p><span style="font-size: 11px;"><img style="float: left;" title="NewImage.png" src="http://sudonetworks.typepad.com/.a/6a0120a7f97018970b0168e694384e970c-pi" border="0" alt="NewImage" width="200" height="149" /></span></p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p>Next, from the AirPcap control panel I provided the WEP key for a specific SSID as follows:</p>
<p><img style="float: left;" title="NewImage.png" src="http://sudonetworks.typepad.com/.a/6a0120a7f97018970b01676193091c970b-pi" border="0" alt="NewImage" width="258" height="214" /></p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p>Then, I launched WireShark and from the Wireless toolbar, I selected 'Driver' from the Decryption Mode pull down:</p>
<p><img style="float: left;" title="NewImage.png" src="http://sudonetworks.typepad.com/.a/6a0120a7f97018970b0163009d3d0a970d-pi" border="0" alt="NewImage" width="600" height="108" /></p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p>Finally, I started capturing 802.11 frames by selecting AirPcap Multi-Channel Aggregator:</p>
<p><img style="float: left;" title="NewImage.png" src="http://sudonetworks.typepad.com/.a/6a0120a7f97018970b0168e694383c970c-pi" border="0" alt="NewImage" width="289" height="138" /></p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<p>Done! 802.11 packets are being captured and are displayed in decrypted format.</p>
<p> </p>
<p>You can achieve the same thing for WPA and WPA2, but this is handled by WireShark, not the by the AirPcap driver.</p>
<p> </p>
<p><strong>References</strong></p>
<p><a href="http://www.riverbed.com/us/products/cascade/wireshark_enhancements/airpcap.php">AirPcap by Riverbed</a></p>
<p><a href="http://www.wireshark.org/">WireShark </a></p>
<p> </p><img src="http://feeds.feedburner.com/~r/sudonetworks/tvhi/~4/0DXEPabiycc" height="1" width="1"/>]]></content:encoded>


<category>Wireless</category>

<dc:creator>Steve Williams</dc:creator>
<pubDate>Thu, 02 Feb 2012 17:23:42 -0500</pubDate>

<feedburner:origLink>http://blog.sudonetworks.com/2012/02/decrypting-wep-with-wireshark-and-airpcap.html</feedburner:origLink></item>

</channel>
</rss><!-- ph=1 -->

