This tool ‘saved the day’ I can tell you. I’ve had cause to use this tool recently where writing a tcpdump to file and using Wireshark simply hasn’t been possible/permitted. Aside from the obvious advantages, immediacy and efficiency of a CLI tool, ssldump also provides some very useful, nicely parsed data around the SSL/TLS connection itself too.

This is a straight copy of my popular Using Wireshark to Decode/Decrypt SSL/TLS Packets post, only using ssldump to decode/decrypt SSL/TLS packets at the CLI instead of Wireshark. Therefore, we start by collecting information about the target access point.Who needs the Wireshark GUI right let’s do this at the command line and be grown up about things.

In order for the data to be suitable for decryption, it is necessary that the WiFi card does not switch channels, but to capture information on one channel on which the target Access Point operates. In the second example, the data will be captured and decrypted using only Wireshark. The first data capture is performed using Airodump-ng, and then the wireless traffic will be decrypted in Wireshark. Next will be shown two examples of capturing WiFi traffic and its decryption.

password to connect to the Access Point.

for this we need Monitor Mode WiFi adapter.

a handshake that occurred between the Client and the Access Point immediately prior to the exchange of decrypted information.

But to use the captured handshake you need a password from the WiFi network. And not any, but exactly the one that happened to transmit the traffic that needs to be decrypted. The main thing you need to understand: to decrypt WiFi traffic, you need a four-landmark handshake. To calculate PTK, you need data from a four-stage handshake, as well as a password from a WiFi network (in fact, you also need other information, such as the network name (SSID), but obtaining this data is not a problem). Thus, it turns out that WiFi traffic for each connection in the same Access Point is encrypted with different PTK, and even for one Client after reconnection, PTK changes. At the same time, PTK is dynamic, that is, it is created anew for each new connection. When transmitting over WiFi, the traffic is encrypted using PTK (the Pairwise transient key can be translated as a Pair of Transition Key). Let’s start with the theory to understand why the process of decrypting WiFi traffic in Wireshark requires some effort and why one cannot simply decrypt any captured WiFi traffic even if there is a password from the Access Point.

Wireshark capture https decrypt