Capturing the WPA 4-Way Handshake

WPA and WPA2 Personal networks use a 4-way handshake to derive the session encryption key from the pre-shared key. Capturing this handshake gives you the material needed for offline dictionary or brute-force cracking. The handshake occurs when a client connects or reconnects to the AP. The fastest way to capture it is to force a connected client to deauthenticate and capture the handshake as it reassociates.

You need monitor mode active and a WPA2 PSK network without MFP required. Confirm both before starting.

Start Targeted Capture

Lock to the target BSSID and channel and start writing to a capture file. Keep this running throughout:

Note the client MAC addresses in the station list. You need at least one associated client to capture a handshake. If no clients are present, use PMKID capture with hcxdumptool instead.

Send a Deauthentication Frame

In a second terminal, send a targeted deauthentication to a specific client. A count of 5 to 10 frames is enough — higher counts risk disrupting the client for too long and missing the reassociation:

Switch back to the airodump-ng terminal immediately after sending the deauth. The handshake appears in the top-right corner of the airodump-ng display:

WPA handshake: AA:BB:CC:DD:EE:FF in the top right confirms a handshake was captured. Stop airodump-ng once you see this.

If the handshake notification does not appear after the deauth, wait 10-15 seconds for the client to reassociate naturally. If it still does not appear, send another deauth burst. Avoid sending continuous deauth (count 0) as it prevents the client from reassociating at all.

Broadcast Deauthentication

If you cannot identify a specific client MAC or want to force all clients to reconnect at once, send a broadcast deauth. This is noisier and less reliable than a targeted deauth:

Verify the Handshake

Before investing time in cracking, verify the captured handshake is complete and usable:

A handshake found message confirms the capture is crackable. If aircrack-ng reports no valid handshake, the capture may contain only partial EAPOL frames. Repeat the deauth and capture process.

For a more detailed verification using hcxtools:

hcxpcapngtool reports exactly how many usable EAPOL pairs were found and for which BSSIDs. This is the most reliable verification before proceeding to cracking.