OmniPeek Support

Decrypting WLAN using keys from another capture

elin05
Posts: 5
Joined: Tue Feb 19, 2013 2:47 pm

Decrypting WLAN using keys from another capture

Postby elin05 » Tue Oct 18, 2016 5:40 pm

I would like to run a continuous capture of encrypted WLAN traffic, to be saved over multiple files. However, the decryption keys are only contained in the first capture file, and thus I cannot decrypt the subsequent files.

Is it possible to decrypt WLAN using keys from a different capture file?

DJWP
Posts: 676
Joined: Tue Oct 30, 2007 11:42 am

Re: Decrypting WLAN using keys from another capture

Postby DJWP » Wed Oct 19, 2016 1:12 pm

As long as you have the EAPOL keys between the STA and AP when they first associate, you should be able to decrypt the traffic with the appropriate key set. If you have a new STA and AP association, then you will need to capture those EAPOL keys and apply a different key set. You can have multiple WLAN keysets stored in your Omnipeek configuration.


Return to “OmniPeek Support”

Who is online

Users browsing this forum: No registered users and 2 guests