Alex V Posted August 28, 2022 Share Posted August 28, 2022 I am having this issue on an mk7 with tcpdump captured wpa2-psk-ccmp encrypted frames: My Wireshark is only able to decrypt L3-L7 for some multicast and broadcast data frames, but not unicast data frames. (When loading other .pcap decryptable example files on the Internet, Wireshark is correctly decrypting all unicast data frames.) The captured EAPOL handshake #3 seems to be correctly decrypted, showing everything in clear: GTK, KEK, KCK. Anyone else ran into this issue? Quote Link to comment Share on other sites More sharing options...
DramaKing Posted August 30, 2022 Share Posted August 30, 2022 Did you make sure to capture all four parts of a handshake? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.