Sniffer® Portable Professional User's Guide - NetScout

Postcapture 802.11 Decryption
Displaying Captured Data
Sniffer Portable Professional can decrypt and decode 802.11 packets
encrypted with either WPA/WPA2 or WEP both during and after capture.
As described in Configuring Wireless Encryption Settings on page 56,
you use the Tools > Wireless > Encryption options to configure the
automatic decryption of encrypted data on wireless networks during
capture. However, you can also perform decryption on trace files
containing frames encrypted with a known WPA passphrase or WEP key
set but not decrypted during capture. There are two ways to do this:
Use the integrated decryption utility accessed from the Decode
tab’s context menu.
Use the standalone WLAN Decryption utility located at
C:\Program Files\NetScout\Sniffer
Portable\bin\WLANDecrypt.exe.
Both approaches do the same thing – decrypt wireless data with supplied
decryption keys. The major difference is that the standalone utility takes
a trace file as input and outputs a decrypted trace file.
To perform offline decryption of encrypted wireless data:
1 Display the Decode tab of a trace file or capture buffer containing
frames encrypted with a known WPA passphrase or WEP key set
but not decrypted during capture.
2 Right-click in the Summary, Detail, or Hex pane to activate the
Decode tab’s context menu.
3 Select Wireless Decryption to open the Select WEP - WPA
Keys dialog box. A sample is shown in Figure 8-18.
User’s Guide 199