weakksa.c and wi_dat_len

Hi,

-----------
Platform where dwepcrack is run = FreeBSD 4.6
bsd-airtools v0.2
-----------

Our problem was that we couldn't find the wepkey, even when we had 7 or
8 millions packets ( using FMS attack ).

While trying to find why we always have too few weak packets, we found
that  dwepcrack used only 3000 or 4000 packets ( from a dumpfile of 
400 000 packets ), and found only 200 weaks IVS.

So we investigated into weakksa.c, and found an average value of
wi_h->wi_dat_len of about 50000, while you reject all packets with
wi_dat_len greater than 2304 ( MAX_PKT_SIZE ).

We are very surprised by this value of 50000. We collected traffic from
a ftp transfer between an AP and a FreeBSD client ( prism2 ) with a
tcpdump running on a linux ( cisco card ).

So here are our thougths :

	- incorrect casting of the output of pcap_next() in struct wi_h
	  ( wi_h = (struct wi_rx_frame *)pkt; )
	
	- maybe our dumps are flawed ( althought ethereal can read them
	  )
	
	- maybe we are totally nuts.... :)


Thanks for your help,


			Mathieu


-- 
		BOFH excuse: temporary routing anomoly