Applying decryption in the Packets view
You can apply a particular key set to decrypt all or some of the encrypted wireless packets in a capture window. An encrypted packet appears in the Packets view with a W in the Flag column and 802.11 TKIP Data, 802.11 Encrypted Data, or 802.11 WEP Data in the Protocols column.
To apply decryption in the packets tab:
1. On the menu, click. The Decrypt WLAN Packets dialog appears.
2. Select All packets, Selected packets only, or those packets in the current window which are Encrypted only. Your key set will be applied to this selection of packets.
IMPORTANT: If you are using a WPA/WPA2 key set, you must select All packets to ensure the inclusion of the four-way handshake authentication that established the PTK (Pairwise transient key) and GTK (Group transient key) used to encrypt the target packets.
3. Select an existing key set under Use key set or browse to open the Key Set options to create a new key set.
4. When you have made your selections, click to apply the chosen key set to the chosen packets. A new capture window opens containing the results of the decryption. This new window has the name of the original target window, with the string “- Decrypted” appended to it.
NOTE: An 802.11 key set cannot be changed while capture is under way. A new key set will not be applied until a capture is stopped and a new capture is created.