Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

12
  • It can't.. it must be decrypting because it has all four, or you are connected to the wifi network and that is decrypting the packets
    – Paul
    Commented Apr 17, 2012 at 5:22
  • I'm (obviously) talking about packets captured in RFMON mode.
    – cYrus
    Commented Apr 17, 2012 at 13:17
  • @Paul: I've edited the question; can you reply?
    – cYrus
    Commented Apr 19, 2012 at 9:28
  • I wish I could. If you follow the EAPOL sequence, the client has the PTK after only the first packet (the anonce is passed). The AP knows the PTK after the second packet (snonce). If you observe these two, and know the MACs, which of course you do, and the ssid+psk, then this should be all you need. The third packet is just GTK for broadcast and multicast, and the fourth is just an ACK. If you are decrypting unicast (which the arp-reply is) then the first two packets should be enough. I can't help but think I am missing something as everything says you need all four.
    – Paul
    Commented Apr 19, 2012 at 11:00
  • Did you get any further with this?
    – Paul
    Commented Apr 23, 2012 at 5:18