Page 1 of 1

Decrypting WLAN using keys from another capture

Posted: Tue Oct 18, 2016 5:40 pm
by elin05
I would like to run a continuous capture of encrypted WLAN traffic, to be saved over multiple files. However, the decryption keys are only contained in the first capture file, and thus I cannot decrypt the subsequent files.

Is it possible to decrypt WLAN using keys from a different capture file?

Re: Decrypting WLAN using keys from another capture

Posted: Wed Oct 19, 2016 1:12 pm
by DJWP
As long as you have the EAPOL keys between the STA and AP when they first associate, you should be able to decrypt the traffic with the appropriate key set. If you have a new STA and AP association, then you will need to capture those EAPOL keys and apply a different key set. You can have multiple WLAN keysets stored in your Omnipeek configuration.