How to decrypt RADIUS traffic using Wireshark with RSA Authentication Manager
Originally Published: 2017-05-19
Article Number
Applies To
RSA Product/ Service Type: Authentication Manager
RSA Version/Condition: 7.x, 8.1, 8.0, 8.1
Issue
Resolution
You must know the RADIUS shared secret used in order to decrypt the packets.
You can follow the below steps to be able to decrypt the Radius Packets:
- Capture RADIUS authentication traffic. See Using tcpdump to troubleshoot authentication issues with RSA Authentication Manager 8.x for more information.
- Launch the Wireshark app.
- Open the capture of of the RADIUS traffic, typically in .pcap format.
- Go to Edit > Preferences.
- Click the + next to Protocols to expand the tree.
- Scroll down and select RADIUS.
- Key in the RADIUS shared secret and click Apply.
- The passcode in clear text.
The packet capture before entering the RADIUS shared secret:
The packet capture after entering the RADIUS shared secret:
