Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1.8.1 from the Backtrack R3.

# tshark -o wlan.wep_key1:wpa-pwd:foo:bar
tshark: -o flag "wlan.wep_key1:wpa-pwd:foo:bar" specifies unknown preference

It appears from other posts that this option has worked before (here and here).

share|improve this question

That option seems to have changed as of 1.8; here is the new syntax:

 tshark  -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\"{PASS}:{SSID}\"" ...

You do need the quote escaping as shown, and obviously substitute {PASS} and {SSID}.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.