The client now has all the attributes to construct the PTK. The AP sends a nonce-value to the STA (ANonce).The actual messages exchanged during the handshake are depicted in the figure and explained below The handshake also yields the GTK (Group Temporal Key), used to decrypt multicast and broadcast traffic. The product is then put through PBKDF2-SHA1 as the cryptographic hash function.

The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address.

Therefore the four-way handshake is used to establish another key called the PTK (Pairwise Transient Key). This key is, however, designed to last the entire session and should be exposed as little as possible. The earlier EAP exchange or WPA2-PSK has provided the shared secret key PMK (Pairwise Master Key). The authentication process leaves two considerations: the access point (AP) still needs to authenticate itself to the client station (STA), and keys to encrypt the traffic need to be derived. As we go through the following steps we will begin using different software packages to see what we can achieve and how fast we can do it. All of this makes wireless monitoring extremely complicated.Ī workaround is to sample every channel for a short duration and then to sniff on a different channel – basically time division multiplexing. the card we use for sniffing would also have to support the band in question. Also, due the different types of WLAN networks – a,b,g,n etc. To effectively sniff multiple channels at the same time, we would need multiple cards. Your wireless card only has one radio, and hence it can only sniff on one channel (in a band) at a given instant. Why? Because wireless using different channels and bands for communication. One of the key learning also is that in wireless unlike the wired side, we cannot sniff and capture all packets in the air. This allows us to view individual packets and then analyze them. Once we set our card to monitor mode, we can sniff the traffic using tools like Wireshark. In wireless, by using the right drivers and supported cards, we can create and inject custom packets into the air. For active prevention, we need the ability to inject arbitrary packets into the air, this ability is called “packet injection”. This is called monitor mode in wireless and we can do this by using a utility called airmon-ng. For monitoring, we need to be able to put our wireless cards into “promiscuous mode” so that it can gather all the packets in the air.

Wireshark tutorial bobol wifi