Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

Question

I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible.

That depends on how the capture device is configured and positioned. Captured encrypted traffic is still encrypted. If you mean that you want to read it as unencrypted, then you are out of luck. — Ron Maupin, Jan 8, 2020 at 6:22
I don’t think so. I just ran a “sudo tcpdump -i en0” on my Mac laptop while browsing some websites on my closely positioned iPad. My WiFi net uses WPA2-PSK with p2p communication allowed. I did not catch any Unicast between the iPad and the Internet in the tcpdump. Behavior may be different on other OS’. While product recommendations are off topic, metageek.com has some other tool options. FYI my access point is a Linksys C7000-1000NAS. — Darrell Root, Jan 8, 2020 at 7:04
On my ubuntu 16.04, only things captured are QoS traffics and broadcast traffics. These traffics include hundreds of Bytes... I think I cannot even capture encrypted traffics. — mallea, Jan 8, 2020 at 8:06
If you did not capture other traffic, then you have not configured your capture host correctly. You can ask about host configuration on Super User. — Ron Maupin, Jan 8, 2020 at 14:38

warashi nguyen · Accepted Answer · 2023-07-13 05:41:16Z

To decrypt WPA-encrypted Wi-Fi traffic in Wireshark, you can follow these steps:

Capture the Wi-Fi packets using a capture tool, such as Wireshark, on a device connected to the same Wi-Fi network.
Export the captured packets to a PCAP file.
Open Wireshark on a computer and go to Edit -> Preferences.
In the Preferences window, select "Protocols" and then "IEEE 802.11."
In the IEEE 802.11 preferences, click on "Edit" next to the "Decryption keys" field.
Add a new decryption key by clicking on the "+" icon.
Enter the SSID (network name) of the Wi-Fi network, choose the encryption type (e.g., WPA or WPA2), and enter the encryption key used by the access point.
Click "OK" to save the decryption key.
Open the captured PCAP file in Wireshark.

1 Answer 1