for this we need Monitor Mode WiFi adapter.a handshake that occurred between the Client and the Access Point immediately prior to the exchange of decrypted information.But to use the captured handshake you need a password from the WiFi network. And not any, but exactly the one that happened to transmit the traffic that needs to be decrypted. The main thing you need to understand: to decrypt WiFi traffic, you need a four-landmark handshake.

To calculate PTK, you need data from a four-stage handshake, as well as a password from a WiFi network (in fact, you also need other information, such as the network name (SSID), but obtaining this data is not a problem).

Thus, it turns out that WiFi traffic for each connection in the same Access Point is encrypted with different PTK, and even for one Client after reconnection, PTK changes. At the same time, PTK is dynamic, that is, it is created anew for each new connection. When transmitting over WiFi, the traffic is encrypted using PTK (the Pairwise transient key can be translated as a Pair of Transition Key). Let’s start with the theory to understand why the process of decrypting WiFi traffic in Wireshark requires some effort and why one cannot simply decrypt any captured WiFi traffic even if there is a password from the Access Point.

Decrypt wireshark packet capture