using wireshark to crack wpa2 with windows

The PTK is never sent over the air in WPA it is computed from the PMK, an AP nonce, a client nonce, the AP MAC address, and the client MAC address (this is 'key exchange', but the PTK never gets transmitted). Please let me know if I am missing something and any pointers to references will also be helpful. If my understanding of point 2 is correct, the 4-way handshake is not encrypted, correct? And this 4-way handshake can still be eavesdropped on (maybe through a monitor mode capture or using tools like Kismet/Wireshark/airodump-ng etc.) correct? It's just the initial nonce that is exchanged and thereafter it is the calculated PTK that is exchanged and it is the MIC that is used for verification. As per my understanding the PSK is not transmitted over the network by either the client or the AP during the connection/authentication process. When we talk about PSK in case of WPA/WPA2, I understand that the PSK (the PMK and PTK finally) are used to encrypt all the data exchange. In fact, is the fake AP even required here? I mean, even without hosting a fake AP, I could still sniff the PSK from a monitor mode capture (say using tools like Wireshark/Kismet/Cain etc.) - correct?

Why do I need to bother to BREAK the WEP or WPA keys (maybe using a tool like aircrack-ng)?Ĭan't I just de-authenticate a client (using aireplay-ng) and then present the client with a fake AP (impersonating a legitimate one) and then, when the client tries to reconnect to the AP, simply capture packets in monitor mode and sniff the key out from those?.(I understand that WEP is no longer recommended but I am just trying to understand some underlying concepts here.) There are a few things that I am not able to correlate and need help understanding them. I am pretty new to the domain of wireless security and am trying to understand the various techniques used for compromising wireless networks.

Using wireshark to crack wpa2 with windows