Skip to main content

Handshake Capture

Handshake Capture records the short exchange that happens when a device joins a Wi-Fi network. Saved captures can be exported as PCAP files and used with standard offline tools (Wireshark, hashcat, aircrack-ng) to audit the strength of a Wi-Fi password.

This is intended for networks you own or have explicit permission to test.

How to Start a Capture​

  • Open the Handshake app from the Wi-Fi Tools menu.
  • The BLEShark scans nearby networks and opens the Select AP list.
  • From that list you can pick All APs to sweep every scanned network, or pick a specific network from the list.
  • If you pick a specific network, the Target screen opens with two options: This AP captures from that single access point, and SSID (N APs) (shown only when the Wi-Fi name appears more than once) captures from every access point sharing that name.
  • Press [S] to start capturing.

5GHz networks are not supported.

What You See During Capture​

The capture screen shows:

  • The target's Wi-Fi name at the top, scrolling if it's longer than the screen.
  • A status line that swaps between "Deauth: N" while sending deauthentication frames and "Listening..." while waiting for the handshake.
  • Four checkboxes across the middle, one for each frame of the handshake. They fill in as each frame is captured.
  • A counter showing "EAPOL N/4" and the elapsed time.
  • At the bottom, either "BCN OK" (confirming the device can see the target's beacons) or "Cap: N/M" in All APs mode (how many networks have been captured out of the total).

Deauthentication is sent in short bursts to prompt clients to reconnect, followed by a quieter listening window so the handshake can complete without being interrupted.

Even a partial handshake (two or three of the four frames) is often enough for modern cracking tools. The device saves what it has and may upgrade the file later if more frames are captured.

When a Capture Finishes​

In This AP and SSID modes, the screen switches to a Captured! summary once the full handshake is recorded, showing "4/4 EAPOL+Beacon", the number of packets saved, and a reminder to export via the portal. Press [S] to return to the Wi-Fi Tools menu.

In All APs mode the app keeps running and rotates through each target automatically. Each network gets a short window of attention, and the device moves on once the handshake completes or the time limit is reached. Networks already captured in this session are skipped on subsequent rotations. Long-press [S] to exit when you're done.

Exporting Captures​

Captures are saved on the device and can be downloaded from the web portal.

  • Open Config -> Transfer on your BLEShark Nano.
  • Connect to the BLEShark Wi-Fi network and open the portal.
  • Under Download files from your device, click Handshake PCAP.
  • The browser downloads a ZIP archive containing every handshake on the device.

Open the files in any tool that reads PCAP, such as Wireshark, hashcat, or aircrack-ng.

Mesh Behaviour​

When Shiver is on and you have paired devices nearby, each Nano that captures a handshake announces it to the rest of the mesh. Other paired devices use those notifications to skip networks that have already been covered, so the mesh doesn't burn cycles re-capturing the same handshake from multiple angles.

The PCAP files themselves do not transfer automatically. Captured handshakes stay on the device that recorded them until you explicitly pull them together.

To gather every paired device's captures onto one Nano:

  • Open Shiver -> Sync.
  • From: pick Other devices, then All Devices.
  • To: This device.
  • What: Handshake files.
  • Press Start.

Once the sync finishes, every handshake from across the mesh is on this Nano, ready to export via the Transfer portal as a single archive. See Sync for more.

tip

Wi-Fi has many channels and the BLEShark Nano can only listen on one at a time. Capture works best when the target and one of its clients are both active and in range while the device is listening on that channel. All APs mode handles the rotation for you.

Legal Disclaimer

Only use Handshake Capture on networks where you have explicit permission.
Unauthorized interception of wireless traffic may violate local laws and result in severe penalties.