Not enough weak keys

"Brian DeLine" <[email protected]> Thu, 21 Nov 2002 14:03:23 -0500
Newsgroups gmane.network.wireless.bsd.airtools
Message-ID <OFBBBFB4B6.1C0CC51C-ON85256C78.0063C92B-85256C78.0068E94F@hermanmiller.com>
I captured 2GB of traffic and I'm not seeing nearly enough weak keys.

The access point is a Linksys BEFW11S4 running 128bit WEP and current firmware.
I'm collecting raw dumps with a Cisco Aironet 350 card (in monitor mode) using Kismet under Linux.
I'm generating traffic with another Aironet 350 and an Orinoco gold card (UDP streams, streaming audio, icmp pings, and a 2GB ftp transfer back and forth).

I'm running dwepcrack on a dual 1.2Ghz FreeBSD 4.7-RELEASE machine, using the following command line:

dwepcrack -f1 -s -j2 -w new.dump

It runs for several minutes and then kicks out:

* dwepcrack v0.4 by h1kari <[email protected]> *
* Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *
reading in captured ivs, snap headers, and samples... done
total packets: 5983953
calculating ksa probabilities...
 0: 36/768 keys (!)
 1: 4983/131328 keys (!)
 2: 7444/197376 keys (!)
 3: 7474/197120 keys (!)
 4: 12368/328703 keys (!)
 5: 12395/328192 keys (!)
 6: 17346/459520 keys (!)
 7: 17277/459264 keys (!)
 8: 22171/590592 keys (!)
 9: 22289/590336 keys (!)
 10: 27145/721664 keys (!)
 11: 27136/721408 keys (!)
 12: 32091/852736 keys (!)
(!) insufficient ivs, must have > 60 for each key (!)
(!) probability of success for each key with (!) < 0.5 (!)

It then begins sending out a whole bunch of periods.  Even though it doesn't have enough IVS, I let it run for a week, but it did not find anything.

Anyone have any suggestions on why I'm not seeing enough weak packets?  Management has asked me to demonstrate why WEP is weak and this certainly isn't helping my case.

Thanks!

Brian DeLine