From 0ceb938f10a057bde82a1ecd1795f0170b36237d Mon Sep 17 00:00:00 2001
From: Simone Margaritelli <evilsocket@gmail.com>
Date: Sat, 17 Aug 2024 12:40:40 +0200
Subject: [PATCH] fix: WPA3 is now correcly identified and reported (fixes
 #1098)

---
 packets/dot11.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/packets/dot11.go b/packets/dot11.go
index cce9c981..38110949 100644
--- a/packets/dot11.go
+++ b/packets/dot11.go
@@ -253,7 +253,13 @@ func Dot11ParseEncryption(packet gopacket.Packet, dot11 *layers.Dot11) (bool, st
 							cipher = rsn.Pairwise.Suites[i].Type.String()
 						}
 						for i = 0; i < rsn.AuthKey.Count; i++ {
-							auth = rsn.AuthKey.Suites[i].Type.String()
+							// https://balramdot11b.com/2020/11/08/wpa3-deep-dive/
+							if rsn.AuthKey.Suites[i].Type == 8 {
+								auth = "SAE"
+								enc = "WPA3"
+							} else {
+								auth = rsn.AuthKey.Suites[i].Type.String()
+							}
 						}
 					}
 				} else if enc == "" && info.ID == layers.Dot11InformationElementIDVendor && info.Length >= 8 && bytes.Equal(info.OUI, wpaSignatureBytes) && bytes.HasPrefix(info.Info, []byte{1, 0}) {