The other day I had a wireless network packet capture file saved as a .cap file. The ESSID that was displaying via normal aircrack-ng output of the WPA/WPA2 wireless packet capture lead me to believe there was at least one space included in the beginning of the ESSID and likely after the ESSID since it was not processing properly using oclHashcat-plus. I had never run into this before so wasn’t exactly sure the easiest way to figure out the number of spaces so I posed the question in the Freenode aircrack-ng IRC channel and got a couple responses which are noted below as well as instructions following the clearest solution.
In the past we have written a couple articles on using tshark to strip WPA capture files down to a specific ESSID or SSID but in some cases it can be more useful to strip the capture down by BSSID or MAC address of the WAP. Isolating packets by BSSID or WAP MAC address is useful in a scenario where a wireless deployment has numerous WAP’s and you have captured a specific SSID’s traffic from more than one WAP. Below is information on how to strip down a capture file based on BSSID and information on capture size before stripping the file down.
It is possible to crack WPA/WPA2 wireless network credentials using any number of open source tools available now including oclHashcat+, aircrack-ng, or pyrit to name a few. If you are having trouble cracking a password it is possible that the network uses RADIUS authentication instead of pre-shared keys(PSK). Now you could see this when if you looked at the details of the network you were attempting to capture authentication packets for as it would display as WPA Enterprise versus WPA Personal. It definitely happens though that this is not considered during the capture so you may need to verify that a network is WPA/WPA2 Personal versus WPA/WPA2 Enterprise once you are attempting to crack the authentication. You can do this using Wireshark and the details below.
Typically when I need to use tshark I do so on a Linux server however there are times where it is convenient to have tshark available on my Windows 7 laptop. The TShark application is installed with Wireshark so installing TShark is very easy using the Wireshark GUI intsaller on Windows. One thing that makes tshark more useful is adding the tshark.exe executable to your PATH on Windows so you can open a command prompt and use TShark from any directory. Follow the directions below to first install Wireshark and then to add the directory that includes tshark.exe to your Windows 7 PATH.
I use tshark sometimes to strip down packet captures based on specific variables and needed to install tshark on a CentOS Linux server I recently built for various development tasks. The problem is that when attempting to install tshark using yum it returned an error because there was no package named tshark available in any of the yum repositories I had configured.