Packets captured not enough IV's with 26MB file????

[robbo007]

Hello all,

I did a capture of a network using KISMAC and grabbed 26MB of data but still I don't have enough IV's??

I use aircrack to try and crack the captured data as it seems to work faster than KISMAC. But no luck either.

Could the reason be because its using WPA or another from of encryption? How can I check what encryption method they are using???

I did a test on my home network with WEP installed and it seemed to grab and start the cracking with no problems??

Any help much appreciated.

Thanks,

Rob

[argh]

hi, yes aircrack is for WEP, not WPA. how many IV packets did you get, that is more important than the capture size.

[robbo007]

Hello,

Aircrack reports zero IV packets. Is that normal for a 26MB file? Or was I just unlucky?

Is there any way of knowing that its WEP encryption? Because I gather if its WPA then KISMAC and Aircrack are not going to assit me and I'll have to take another approach.

Thanks,

Rob

[argh]

i am not familiar with Kismac, but i believe Aircrack is for WEP only. recent versions of Kismet can detect WPA. for WPA, one of the best tools remains cowpatty. once you have the needed PSK or EAP info, it then is basically a brute-force attack.

[bbulkow]

Quietly, WEP has gotten better. With small changes to the code, access points and cards can emit fewer weak keys. If you happen to be capturing an access point with good hardware, you may not find weak keys. Or you might. Depends on the quality of the code.

WPA vs WEP. If you fire up a windows machine and look at the network, it tells you whether it's WPA or WEP, in plain text. In linux, I know that Atheros chips will show you on an iwlist ... scanning which are WPA and which are WEP. But since the 802.11 parsing code is on a per-driver basis, there's not guarentee that different drivers act the same way.

[dramirez]

latest aircrack 2.2 does support WPA, also note that you no longer need a lot of weak IV packets, just enough IV packets (thanks to statistical attacks by Korek )

http://www.cr0.net:8040/code/network/aircrack/