# Decrypting WPA Traffic with Airdecap-ng and Wireshark

> Decrypt captured WPA/WPA2 wireless traffic using Airdecap-ng and Wireshark after obtaining the PSK or PMKID during post-exploitation analysis.

- **URL:** https://hackindex.io/platforms/wireless/post-exploitation/decrypting-wpa-traffic-airdecap-wireshark
- **Path:** Wireless > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/wireless/post-exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-07-10

Once the WPA/WPA2 passphrase is recovered, captured traffic can be decrypted offline. The capture must contain the 4-way handshake for the session you want to decrypt: the handshake establishes the per-session PTK that encrypts data frames. Any traffic captured before the handshake cannot be decrypted even with the PSK. This is why capturing the handshake alongside the data traffic from the beginning of a session is important.

## Decrypt WPA Traffic with airdecap-ng

airdecap-ng strips the 802.11 headers and decrypts WPA/WPA2 data frames using the recovered passphrase:

```bash
airdecap-ng -p recoveredpassword -e TargetNetwork handshake-01.cap
# Total number of packets read          9841
# Total number of packets written        6203
# Total number of WEP data packets          0
# Total number of WPA data packets       6203
# Number of plaintext data packets          0
# Number of decrypted WEP  packets          0
# Number of decrypted WPA  packets       5891
```

`-p` specifies the passphrase. `-e` specifies the SSID: required because the PMK is derived from both the passphrase and the SSID. The output file is `handshake-01-dec.cap` containing decrypted Layer 3 and above frames as standard Ethernet encapsulation readable by any tool.

If decrypted WPA packets shows 0 despite a correct passphrase, the capture may not contain the handshake for the session being decrypted. The handshake must precede the data frames in the same capture file.

## Filter to a Specific Client

To decrypt only the traffic for a specific client MAC:

```bash
airdecap-ng -p recoveredpassword -e TargetNetwork -b AA:BB:CC:DD:EE:FF handshake-01.cap
```

`-b` filters decryption to frames associated with the specified BSSID. Useful when the capture contains traffic from multiple APs.

## Decrypt Inline in Wireshark

Wireshark can decrypt WPA traffic on the fly without producing a separate decrypted file. Go to Edit > Preferences > Protocols > IEEE 802.11 > Decryption keys and add a new entry. Select type `wpa-pwd` and enter the passphrase and SSID separated by a colon:

```bash
wireshark handshake-01.cap
```

In Wireshark the decryption key format is:

```bash
wpa-pwd:recoveredpassword:TargetNetwork
```

After adding the key, reload the capture with Ctrl+Shift+R. Wireshark decrypts data frames inline and the full protocol stack becomes visible in the packet details. Filter on `http`, `dns`, or `ftp` to quickly identify plaintext traffic of interest.

## Extract Credentials from the Decrypted Capture

Once decrypted, use tshark to extract credentials and interesting data from the decrypted file. Focus on these protocol types:

- HTTP POST requests: form submissions with usernames and passwords in plaintext.
- DNS queries: reveals which internal and external hosts clients are connecting to.
- FTP/Telnet: credentials transmitted in cleartext.
- HTTP cookies: session tokens that may be reusable for session hijacking.
- SMTP/IMAP: email credentials if sent without TLS.

```bash
tshark -r handshake-01-dec.cap -Y "http.request.method==POST" -T fields -e ip.src -e http.host -e http.file_data
```

```bash
tshark -r handshake-01-dec.cap -Y "dns.flags.response==0" -T fields -e ip.src -e dns.qry.name | sort -u
```

```bash
tshark -r handshake-01-dec.cap -Y "http.cookie" -T fields -e ip.src -e http.host -e http.cookie
```

## Combine Capture Files

If the handshake was captured in one file and subsequent data traffic in another, merge them before decrypting:

```bash
mergecap -w combined.cap handshake-01.cap data-capture-01.cap
```

```bash
airdecap-ng -p recoveredpassword -e TargetNetwork combined.cap
```

## References

- [Aircrack-ng: airdecap-ng documentation](https://www.aircrack-ng.org/doku.php?id=airdecap-ng) - WPA decryption flags, SSID requirement, and output file reference
- [Wireshark Wiki: How to decrypt 802.11](https://wiki.wireshark.org/HowToDecrypt802.11) - WPA decryption key format and preferences configuration