Selecting Wireshark uses Wireshark's built-in decryption features.

As shown in the window you can select between three decryption modes: None, Wireshark, and Driver: This will open the decryption key managment window. Click on the Decryption Keys… button on the toolbar: If the toolbar isn't visible, you can show it by selecting View->Wireless Toolbar. If you are using the Windows version of Wireshark and you have an AirPcap adapter you can add decryption keys using the wireless toolbar. wpa-psk The key is parsed as a raw pre-shared WPA key.This may not work for captures taken in busy environments, since the last-seen SSID may not be correct. You can optionally omit the colon and SSID, and Wireshark will try to decrypt packets using the last-seen SSID. wpa-pwd The password and SSID are used to create a raw pre-shared WPA key.wep The key must be provided as a string of hexadecimal numbers, with or without colons, and will be parsed as a WEP key.Ī1:b2:c3:d4:e5 0102030405060708090a0b0c0d.When you click the + button to add a new key, there are three key types you can choose from: wep, wpa-pwd, and wpa-psk: You should see a window that looks like this: You should see a window that looks like this:Ĭlick on the 'Edit…' button next to 'Decryption Keys' to add keys. Go to Edit->Preferences->Protocols->IEEE 802.11.

You can add decryption keys using Wireshark's 802.11 preferences or by using the wireless toolbar. WPA/WPA2 enterprise mode decryption works also since Wireshark 2.0, with some limitations. Wireshark can decrypt WEP and WPA/WPA2 in pre-shared (or personal) mode.

Wireshark certificate decrypt