Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that WPA/WPA2 encryption is a pretty good safeguard against snooping by people outside a wireless network. But can someone in the network (i.e. who has been given the shared key) monitor/intercept the traffic (e.g. plain http browsing) of another user on the same network?

EDIT: additional scenario: Alice is on wireless; Bob is connected via ethernet cable to the router. Can Alice intercept Bob's traffic?

share|improve this question
add comment

5 Answers

up vote 3 down vote accepted

No they can't. WPA/WPA2 provides different per session key for data encryption. PSK start with the same passphrase, however each station is given different key for unicast traffic. The only traffic you will see(or decrypt) through sniffer is broadcast packet. So the situation is same as you sniffer traffic when you are connected to wire switch.

q2) No. alice is not able to intercept.

share|improve this answer
add comment

The short answer is, no, with only the pre-shared key (PSK) you cannot decrypt other user's traffic, but, it is fairly simple to collect the additional information needed. Stations don't directly use the PSK to encrypt packets. Instead, they use the PSK to generate a Pairwise Master Key (PMK) which in turn generates the Pairwise Transient Key (PTK) used for encrypting packets. Both parties, the station and access point (AP), calculate the PTK using nonces (random numbers), the MAC addresses, and a couple other pieces of data combined with the PMK. All the data other than the PSK is in the 4-way handshake and is not encrypted.

So knowing the PSK and collecting the 4 frames of the RSN protocol (a.k.a the 4-way handshake) is enough information to feed into something like Wireshark and decrypt traffic between a station and AP. You can argue that collecting the data from the 4-way handshake is timing sensitive, but several (free) tools exist that allow a third party to forge de-authentication packets enabling an attacker to better predict when to capture this information.

share|improve this answer
add comment

Alice cannot see any of Bob's traffic that does not communicate with other wireless users or broadcast traffic. Alice could see the traffic from Bob to wireless users but the traffic would be encrypted (except possibly for broadcast).

As Joshua said, each computer will have its own session key so other users will not be able to read the data.

share|improve this answer
add comment

Directly, no. In terms of ARP floods or man-in-the-middle attacks (in ARP or at a higher level), these will be prevented by some access points that can be set to disallow direct traffic between wireless clients. ie all clients can see networks on the uplink side of the AP, but traffic addressed from one wireless client to another will be dropped.

share|improve this answer
add comment

As for whether a wired user can get the traffic, it's complicated. If Bob is passively eavesdropping on a switched port, he won't see much in normal operation. If the wireless and wired networks are one ethernet segment, and the ARP tables in the switching part of the router overflow and it starts broadcasting everything to everyone, then Bob will see everything in the clear. Bob can induce this by ARP flooding, or he can be more subtle and spoof ARP of a router distinct from the access point.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.