Sniffer® Portable Professional User's Guide - NetScout

Sniffer® Portable Professional User's Guide - NetScout Sniffer® Portable Professional User's Guide - NetScout

10.03.2013 Views

Chapter 8 Sniffer Portable Professional can decrypt both WPA/WPA2 and WEP encrypted packets simultaneously. Use these options to specify the keys to use for decryption of WEP-encrypted data. WEP is an early 802.11 encryption technology and is not as commonly seen as WPA-WPA2. Use these options to specify the passphrase used to decrypt data on different SSIDs (wireless networks). 200 Sniffer Portable Professional Figure 8-18. Select WEP - WPA Keys Dialog Box Use the Select WEP-WPA Keys dialog box (Figure 8-18) to specify the WEP and/or WPA keys to be used for decrypting the data in the selected buffer or trace file. 4 To specify new WEP keys for decryption, start by setting the WEP Key Entry Mode option to specify whether you want to enter the keys as either Hex or ASCII. Then, enter up to four separate encryption keys. For each key, do the following: a Specify the length of the key by selecting the appropriate option. Keys can be either None, 40-bit, or 128-bit. Use the None option if no encryption is used on the network. Depending on the length of the key specified, some or all of the adjacent fields become active, enabling you to specify the keys in use. b Specify the exact value for each key in the adjoining spaces provided. NOTE: The four encryption keys in use on a WEP-encrypted network are all typically the same length — either 40-bit or

128-bit. 5 To specify new WPA-WPA2 keys for decryption: Displaying Captured Data a Turn on the encryption key by checking its On radio button. b Specify the SSID for the WPA/WPA2-encrypted network. This is typically a short string used to identify a wireless network (for example, labnet). c WPA/WPA2 encryption relies on a pre-shared passphrase for encryption. Enter the passphrase associated with this SSID. d Repeat Step a though Step c for each SSID you expect Sniffer Portable Professional to monitor. 6 Click OK on the Select WEP-WPA Keys dialog box. Sniffer Portable Professional attempts to use the specified keys to decrypt the data in the selected buffer or trace file and opens a new window with the results. If you specified the correct keys, the new window displays the newly-decrypted data. You can save the decrypted data to a new trace file using the usual File > Save command. IMPORTANT: Make sure the data to decrypt includes four EAPOL Exchange packets for each SSID/passphrase combo you have entered. You can obtain these packets by capturing the Client to AP association packets. If these EAPOL Exchange Packets are not present, the corresponding WPA/WPA2-encrypted packets cannot be decrypted. NOTE: An easy way to determine whether you have entered the correct WEP keys is to check for the presence of a large number of WEP-ICV Error Expert alarms. If there are an abnormally large number of these alarms, you probably have not entered the correct WEP keys for the encrypted data in the selected buffer or trace file. User’s Guide 201

Chapter 8<br />

Sniffer <strong>Portable</strong> <strong>Professional</strong> can decrypt<br />

both WPA/WPA2 and WEP encrypted<br />

packets simultaneously.<br />

Use these options to specify the<br />

keys to use for decryption of<br />

WEP-encrypted data. WEP is an<br />

early 802.11 encryption<br />

technology and is not as<br />

commonly seen as WPA-WPA2.<br />

Use these options to specify<br />

the passphrase used to<br />

decrypt data on different SSIDs<br />

(wireless networks).<br />

200 Sniffer <strong>Portable</strong> <strong>Professional</strong><br />

Figure 8-18. Select WEP - WPA Keys Dialog Box<br />

Use the Select WEP-WPA Keys dialog box (Figure 8-18) to specify<br />

the WEP and/or WPA keys to be used for decrypting the data in the<br />

selected buffer or trace file.<br />

4 To specify new WEP keys for decryption, start by setting the WEP<br />

Key Entry Mode option to specify whether you want to enter the<br />

keys as either Hex or ASCII. Then, enter up to four separate<br />

encryption keys. For each key, do the following:<br />

a Specify the length of the key by selecting the appropriate<br />

option. Keys can be either None, 40-bit, or 128-bit. Use the<br />

None option if no encryption is used on the network.<br />

Depending on the length of the key specified, some or all of<br />

the adjacent fields become active, enabling you to specify the<br />

keys in use.<br />

b Specify the exact value for each key in the adjoining spaces<br />

provided.<br />

NOTE: The four encryption keys in use on a WEP-encrypted<br />

network are all typically the same length — either 40-bit or

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!