I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible.

Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

  • 2
    That depends on how the capture device is configured and positioned. Captured encrypted traffic is still encrypted. If you mean that you want to read it as unencrypted, then you are out of luck.
    – Ron Maupin
    Jan 8, 2020 at 6:22
  • I don’t think so. I just ran a “sudo tcpdump -i en0” on my Mac laptop while browsing some websites on my closely positioned iPad. My WiFi net uses WPA2-PSK with p2p communication allowed. I did not catch any Unicast between the iPad and the Internet in the tcpdump. Behavior may be different on other OS’. While product recommendations are off topic, metageek.com has some other tool options. FYI my access point is a Linksys C7000-1000NAS. Jan 8, 2020 at 7:04
  • On my ubuntu 16.04, only things captured are QoS traffics and broadcast traffics. These traffics include hundreds of Bytes... I think I cannot even capture encrypted traffics.
    – mallea
    Jan 8, 2020 at 8:06
  • If you did not capture other traffic, then you have not configured your capture host correctly. You can ask about host configuration on Super User.
    – Ron Maupin
    Jan 8, 2020 at 14:38

1 Answer 1


To decrypt WPA-encrypted Wi-Fi traffic in Wireshark, you can follow these steps:

  1. Capture the Wi-Fi packets using a capture tool, such as Wireshark, on a device connected to the same Wi-Fi network.

  2. Export the captured packets to a PCAP file.

  3. Open Wireshark on a computer and go to Edit -> Preferences.

  4. In the Preferences window, select "Protocols" and then "IEEE 802.11."

  5. In the IEEE 802.11 preferences, click on "Edit" next to the "Decryption keys" field.

  6. Add a new decryption key by clicking on the "+" icon.

  7. Enter the SSID (network name) of the Wi-Fi network, choose the encryption type (e.g., WPA or WPA2), and enter the encryption key used by the access point.

  8. Click "OK" to save the decryption key.

  9. Open the captured PCAP file in Wireshark.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.