Is it possible to sniff for all packets on an encrypted wifi SSID if you know the password?
Does the SSID password provide only general isolation for all devices as a group within the SSID, or does it establish completely independent isolation between devices, to prevent general traffic sniffing?
In this case I am thinking mainly about the common WPA2 Personal / TKIP / preshared key, but is the answer different for the various other wifi encryption methods?
First, I want to clarify a few things. Then, to better answer your questions, I will provide a brief explanation of how WPA2 works. Finally, I will directly answer your questions.
TKIP and AES are the actual encryption methods. TKIP is not secure in any circumstance and actually no longer supported by modern 802.11 (since 802.11n, if you use TKIP, devices are supposed to disable the HT data rates leaving you with a maximum data rate of 54Mbps or 802.11g speeds).
WPA/WPA2 are the methods used to provide the encryption keys for use between the access point and the station. AFAIK WPA/AES is still secure today, but WPA was a "quick fix" to a couple of the major problems with WEP. There is no reason to use WPA instead of WPA2 so one should really only be using WPA2/AES (either Personal/PSK or Enterprise) unless there is a specific reason to do otherwise.
So, for WPA2 to start, both sides need a common starting point (the "Pairwise Master Key" or PMK) on which to build the encryption key ("Pairwise Transient Key" or PTK). When using WPA2-Personal or WPA2-PSK, the PMK is the (hashed) Pre-Shared Key (PSK).
The PTK is created by combining and hashing the following values: the PMK, the authenticator nonce value or ANonce, the supplicant nonce value or SNonce, the MAC address of the AP (BSSID), and finally the MAC address of the station. (Wikipedia entry for Cryptographic nonce for further background if desired.)
The information for the PTK is exchanged in a four way handshake:
Once this is done, both the station and the AP have been able to generate the PTK and know that the other side has been able to do so as well.
Is it possible to sniff for all packets on an encrypted wifi SSID if you know the password?
The PSK is not a password or used to directly encrypt the data. Rather it is used as the PMK used to generate the PTK. Each session between a station and the access point ends up with a unique encryption key.
However the answer to this question is that yes it is possible, but to do so the person capturing must know the PSK (which again is the PMK) AND capture the four way handshake where the PTK is generated.
It is fairly trivial to cause a station to re-initialize this connection so you can capture the handshake. This is often done by spoofing a deauthentication frame from the AP to the stations causing them to reconnect.
Does the SSID password provide only general isolation for all devices as a group within the SSID, or does it establish completely independent isolation between devices, to prevent general traffic sniffing?
As I detailed above, each PTK is unique not only to the station, but to the connection/session because of the Nonce values. So in general terms, they are isolated.
Keep in mind when using PSK, all stations share/know the same PMK material, so if they really wanted to capture the traffic from other stations this would be possible providing the capture the handshake.
In this case I am thinking mainly about the common WPA2 Personal / TKIP / preshared key, but is the answer different for the various other wifi encryption methods?
This is true with any method that uses the same known fixed value for the PMK. So how can one not use a fixed value for the PMK? Through the use of WPA2-Enterprise.
WPA2-Enterprise is more secure because each and every authenticated station will have a unique PMK, and the PMK will be unique every time the station connects. The PMK is supplied from the RADIUS authentication server (to both the station and the access point) during the authentication process while the station is first connecting (before the handshake).
Note: I did reuse parts of the answer I posted on a similar question over at one of our sister sites, Information Security.
The above answer is spot on - very detailed and insightful. One thing I would like to add is the what environment your performing this capture on? If its in an enterprise environment, you can simply set up a port monitor session closest to the device and have the source be the port going to outbound network traffic and the destination be to your laptop/desktop. Simply have all the traffic mirrored to the port that is headed outbound, if you have a couple SVI/Vlans that segment out the wireless traffic from the local traffic, you'd be able to capture all traffic leaving that interface. We have a Wireless Lan Controller ( 4402 ) going to our 2960-S switch then to our 2900 series router. Whenever i'm doing a monitor, I simply mirror the ports I want to monitor or capture and review the data that way.
