用Wireshark提取WPA握手包

打开Wireshark，在Filter中添写

“eapol.type == 3 or wlan.fc.type_subtype == 0x08”

然后保存Filter后数据:File->Save as，分别选中[All packets]和[Displayed]，然后起名保存即可。

wireshark -r File.cap -R "eapol.type == 3 or wlan.fc.type_subtype == 0x08" -w res.cap

or "pyrit" strip

pyrit -r wpapsk-linksys.dump.gz -o wpapsk-linksys_stripped.dump.gz strip

http://code.google.com/p/pyrit/wiki/Tutorial