Page History

...

This article explains how to capture and decrypt RADIUS traffic using Wireshark.

If using PAP authentication protocol, then Steps in this article will explain how to decrypt the traffic to be able to see the username and passcode in plain text.

Start by installing Wireshark on the same server as DualShield.

Capture RADIUS packets

1. Launch the Wireshark app
2. Select "Capture | Options"
   Image Modified
3. Enter "udp port 1812" in the Capture filter to capture UDP packet only
4. Click the "Start" button to start capture
5. Click "Capture | Stop" to end capture

Decrypt RADIUS packets

1. You will now be able to view the Access-Request and Challenge packets

Image Added

Decrypt RADIUS packets (PAP authentication only)

1. Go to Edit > PreferencesGo to Edit > Preferences
2. Click to expand the Protocols treethe Protocols tree
3. Scroll down and select RADIUS
   
   Image Modified
   
   
4. Enter the RADIUS shared secret and click OK to save
5. Enter "radius" in the display filter to display RADIUS traffic only
6. Select the "Access-Request" packet to examine, and check the Attribute Value Pairs to find the decrypted username and password

...

1. click OK to save