Another way, likely more popular, is to just reboot the device - like a smart phone, laptop, whatever, or disconnect the wifi and reconnect. Not all have this feature readily available, but some do. There are a couple of ways to do this: go to the AP or wireless controller and kick the client off. To get EAPOL frames, you need to have the device re-authenticate.I use those adapters all the time to capture traffic and they work fine, so I will hypothesize there is something specific about your setup causing issues.Good place to put a trace for review by the community: Share a trace - this will go faster if you post a short trace of what you do get - the people on this site are very good at looking at traces and troubleshooting - without the trace, the community is left to guess.I assume you have seen this, but just to be sure:.Reconnected my devices to the wifi so it captures the handshake nothing at all, done every time I start wireshark.Īfter doing everything as aforesaid, all I still see is just encrypted packets no EAPOL or HTTP traffic.Ĭan someone please guide where am I going wrong?.started wireshark without Sudo command.started wireshark with Sudo command (I know its not supposed to be done yet I gave a go).Started wireshark with airmon running in the background.Started wireshark without airmon running in the background.Added decryption keys in the wireless protocol IEEE 802.11 enabled/disabled Assume FCS etc.Wifi is PSK2 - So I have already got the psk key from Wireshark psk calculator, the name of the ssid is Cisco01096 and password is arnold06.Platform: KALI Linux running on Virtual Box over Macbook Air.Here are few details that will list out what I exactly did. I am having a bit of a problem here with wireshark, no matter what I do or what I try to do Wireshark doesnt capture EAPOL traffic that means no handshake capture which means no decryption of HTTP/TCP traffic.

Wireshark mac not capturing packets