Problem Extracting Hash from Captured WPA2 Handshake (M1-M2)

[unmed]

Hi,

I have a problem extracting Hashes from a WPA2 Handshake captured using Wireshark/TShark (not at the same time) by monitoring interface that was acting as an AP. I am using hcxpcapngtool but it does not seem to extract any hashes even though it seems to me that valid M1 and M2 from the 4-Way Handshake were captured. 

The Tool is giving me the following output:

Code:

hcxpcapngtool 6.3.5 reading from tshark.pcapng... summary capture file -------------------- file name................................: tshark.pcapng version (pcapng).........................: 1.0 operating system.........................: Linux 6.16.8+The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali)-amd64 application..............................: Dumpcap (Wireshark) 4.6.3 interface name...........................: wlan1 interface vendor.........................: 000000 openSSL version..........................: 1.1 weak candidate...........................: N/A MAC ACCESS POINT.........................: 000000000000 (incremented on every new client) MAC CLIENT...............................: 000000000000 REPLAYCOUNT..............................: 0 ANONCE...................................: 0000000000000000000000000000000000000000000000000000000000000000 SNONCE...................................: 0000000000000000000000000000000000000000000000000000000000000000 timestamp minimum (timestamp)............: 19.02.2026 16:36:20 (1771518980) timestamp maximum (timestamp)............: 19.02.2026 16:36:23 (1771518983) duration of the dump tool (seconds)......: 3 used capture interfaces..................: 1 link layer header type...................: DLT_EN10MB (1) endianness (capture system)..............: little endian packets inside...........................: 8 EAPOL ANONCE error corrections (NC)......: not detected session summary --------------- processed pcapng files................: 1

When looking in my capture I can see Message 1 and Message 2 Packets that belong together and have the Nonces set to valid values. I am attaching the capture because this was just a test not using real values (the password is password).

Do you have any idea on what might be the problem?

[unmed]

So after sleeping about it and looking at the capture again it occured to me that what I have captured was not full 802.11 frames. i think for some reason monitor mode was disabled before the capture.

This thread can be closed.