I tried with another phone, a Nokia n97 which is not android, and it works good i can see everything.

and manual deauth/auth got EAPOL, but it's like the traffic isn't decrypted correctly? I tried forcing deauth several times with aireplay etc. Why wireshark can decrypt my PCs traffic but it will not decrypt traffic of android or ios device? (i am not connected to the 3G but really to my local network, tried airplane mode with wifi too) and instead of clear traffic i got a bunch of: 'IEEE 802 Null function (no data)' entries in wireshark. (iphone and huawei android) i can see the EAPOL keys coming in wireshark, but when i browse something on the phone, nothing clear showing in wireshark, not even the 192.168.1.x addresses IP. When i browse something on the laptops, i see the traffic clear (HTTP headers etc.) and see the local IP addresses (192.168.1.x) in wireshark.īut, when i connect my 2 phones to the AP. (Of course, i just had to deauth then reauth the computers in order to capture the EAPOL keys with wireshark) I can capture the traffic of my 3 others laptop computers connected with wifi to the AP (two Windows XP and one Vista) with no problem.

Both PolarProxy (our tool) and SSLsplit can export the proxied traffic to a PCAP file in decrypted form. I set my WPA key in wireshark, and running wlan interface in monitor mode enabled. 1 Answer Sorted by: 0 You can redirect the traffic from the rooted android device to a transparent TLS proxy, which decrypts and re-encrypts the TLS traffic while leaving the WebSocket data untouched. I am trying to capture the Wifi traffic of my home network with Wireshark.įor that, i run a Backtrack Live CD on a laptop with a DLINK AirPlus DWL g650 wifi adapter.

Wireshark android traffic