Experiment 14 — WPA2 Authentication Traffic Analysis in Wireshark

Manual pages: 108–110 | Tool: Wireshark

AIM

To capture/analyze WPA2 authentication traffic and observe the WPA2 four-way handshake and encrypted wireless communication between client and access point.

EXECUTION STEPS

Use your own or an authorized WPA2-secured Wi-Fi network and a supported capture-capable wireless adapter. Launch Wireshark.
Choose Wi-Fi adapter. Where supported, enable monitor/raw 802.11 capture. Promiscuous mode alone is not guaranteed to expose Wi-Fi management frames or the WPA2 handshake.
Start packet capture. Reconnect your own client to the authorized WPA2 Wi-Fi network to generate authentication traffic.
Apply Wireshark display filter eapol. Inspect EAPOL-Key packet sequence M1, M2, M3, M4 if visible.
Optionally apply wlan.fc.type_subtype == 0x08 to view 802.11 Beacon frames when raw 802.11 capture is available.
Read source/destination, frame protocol and handshake progression; stop and save .pcapng. No need to obtain network passwords or attempt decryption for this lab observation.

EXPECTED OUTPUT

EAPOL-Key: Message 1 of 4
EAPOL-Key: Message 2 of 4
EAPOL-Key: Message 3 of 4
EAPOL-Key: Message 4 of 4

Capability note: Depending on Windows/Npcap/adapter, a normal Wi-Fi capture may show only higher-layer packets, not EAPOL or 802.11 control/management frames. If absent, state the capture limitation instead of fabricating results.

RESULT

Thus, WPA2 authentication traffic and the four-way handshake were examined in Wireshark where supported by an authorized compatible capture setup.

VIVA

WPA2 protects Wi-Fi connections; EAPOL is involved in key handshake exchange.
Four-way handshake messages are M1–M4.
eapol displays EAPOL frames; wlan.fc.type_subtype == 0x08 displays beacon frames (when 802.11 headers exist).