|
As it has been mentioned
throughout this product's documentation, CommView for WiFi is
capable of decrypting WEP- and WPA-encrypted network traffic on the
fly. To take full advantage of this functionality, you should have
a good understanding of the underlying cryptographic
principles.
WEP
(Wired
Equivalent Privacy) is a mechanism used to
provide data security in wireless networks. WEP allows the
administrator to define a set of keys (or just one key) for the
WLAN. These keys are shared among the clients and access points and
are used for encrypting data before it is transmitted. If a client
doesn't have the correct WEP key, it cannot decrypt the received
packets or send data to other clients, which prevents unauthorized
network access and eavesdropping. WEP decryption is rather
straightforward as long as you have the correct key. WEP is a
static and stateless encryption system, which means that once you
have entered the correct key in the
WEP/WPA Keys
dialog,
CommView for WiFi will be immediately able to decrypt
packets.
WPA
(Wi-Fi Protected Access) came as a replacement for
the less secure WEP standard. WPA
addresses many of WEP's security and privacy concerns,
significantly increasing the level of data protection and access
control for WLANs. Unlike WEP, WPA is a dynamic encryption system
that uses rekeying, unique per-station keys, and a number of other
measures to improve security. WPA features two modes,
PSK (Pre-Shared Key) and Enterprise, which differ in a number of
ways. CommView for WiFi supports decryption of WPA in PSK
mode.
Given the dynamic nature
of WPA encryption, knowing the WPA passphrase alone doesn't allow
you to decrypt traffic immediately after entering the correct
passphrase. To be able to decrypt WPA-encrypted traffic, CommView
for WiFi must be running and capturing packets during the key
exchange phase (key exchange is carried out using the EAPOL
protocol). It's important that all of the EAPOL key exchange
packets be successfully captured. A damaged or missing EAPOL packet
will make it impossible for CommView for WiFi to decrypt packets
that will be sent to/from the given station, and capturing the next
EAPOL conversation between the AP and station may be required. This
is an important distinction in the way WEP and WPA traffic is
decrypted.
The principles explained
above mean that once you have entered the WPA passphrase, closed
the
WEP/WPA Keys
dialog, and
started capturing packets, you will need to wait for the next
authentication and key exchange event before the packets can be
decrypted for the station that has been authenticated. Naturally,
it's not uncommon that the program can decrypt packets to/from one
client, but not to/from another, as it may have not yet captured
EAPOL packets for all of the clients.
Re-authentication can be
triggered by using the
Node
Reassociation tool, by restarting the AP
(for all authenticated stations), or by reconnecting to the network
(for the given client).
|
