sample wireshark captures in pdf with explanation

IEEE 802.11 → Frame Control → Flags → DS Status Flag: The direction flags show “FROM DS” or “TO DS” depending on the packet. This is because the aircrack-ng “resets” handshake sets when association packets and similar are seen. For example, if the beacon packet sequence number is higher then the EAPOL packet sequence numbers from the AP, the handshake will be ignored. Ensure this beacon is part of the same packet sequence numbers. Aircrack-ng also requires a valid beacon. If they don't, then they are not part of the matching set. EAPOL packets 1 and 3 should have the same nonce value. There are some other items to point out if you are analyzing a capture looking for a valid capture. That is why sometimes you have four EAPOL packets in your capture but aircrack-ng still says there are “0” handshakes. If you have only one packet for a specific “replay counter” value then you are missing it from the capture and packet you do have cannot be used by aircrack-ng. Packets with the same “replay counter” value are matching sets. The second pair has a “replay counter” value of 2. The first pair of packets has a “replay counter” value of 1. Notice that the AP initiates the four-way handshake by sending the first packet. These are the four critical packets required by aircrack-ng to crack WPA using a dictionary. These are the four “handshake” WPA packets. By understanding this capture, you can then compare it to a live capture and hopefully find out what is going wrong. It allows you to troubleshoot a connection if you are having problems. The captures were done using an Ralink RT73 chipset and airodump-ng as the capture program.īeing able to read a capture file is an important skill to learn and build on. See this FAQ entry to learn how to use Wireshark. You will need to scroll through the fields for each packet to locate the ones mentioned. This shows all the sections and fields expanded. To view the capture, use Wireshark to open it then “View” then “Expand All”.

This is the link to download the PDF directly. The best document describing WPA is Wi-Fi Security - WEP, WPA and WPA2. The Wiki links page has a WPA/WPA2 section. This tutorial is a companion to the How to Crack WPA/WPA2 tutorial.

The second file () is a capture of a wireless client attempting to use the wrong passphrase to connect to the AP. The first file () is a capture of a successful wireless client WPA connection to an access point. This is quick and dirty explanation of two sample WPA capture files.

Sample wireshark captures in pdf with explanation