Wireshark (authorized WPA2 Wi-Fi + compatible wireless capture adapter):
Display filter: eapol
Protocol: EAPOL | Info: Key (Message 1 of 4)
Protocol: EAPOL | Info: Key (Message 2 of 4)
Protocol: EAPOL | Info: Key (Message 3 of 4)
Protocol: EAPOL | Info: Key (Message 4 of 4)

Display filter: wlan.fc.type_subtype == 0x08
802.11 Beacon frames (if monitor/raw 802.11 available)

Note: these are illustrative annotations; actual Info field wording varies. Ordinary Ethernet or Wi-Fi adapter capture may NOT show raw WPA2 handshake frames. No handshake is not proof WPA2 failed.
