Re: Not enough weak keys

Brian,

To me it looks like you have too many packets. The warning on there is just
saying that it'll require brute forcing, when you get > 60 for each key you
should get the key immediately without any brute forcing. Otherwise, you
only need  ~ > 20. Also, are you using dwepdump to capture the traffic? If
not, it's gonna cause you problems.

-h1kari


On 11/21/02 11:03, "Brian DeLine" <[email protected]> wrote:

> I captured 2GB of traffic and I'm not seeing nearly enough weak keys.
> 
> The access point is a Linksys BEFW11S4 running 128bit WEP and current
> firmware.
> I'm collecting raw dumps with a Cisco Aironet 350 card (in monitor mode) using
> Kismet under Linux.
> I'm generating traffic with another Aironet 350 and an Orinoco gold card (UDP
> streams, streaming audio, icmp pings, and a 2GB ftp transfer back and forth).
> 
> I'm running dwepcrack on a dual 1.2Ghz FreeBSD 4.7-RELEASE machine, using the
> following command line:
> 
> dwepcrack -f1 -s -j2 -w new.dump
> 
> It runs for several minutes and then kicks out:
> 
> * dwepcrack v0.4 by h1kari <[email protected]> *
> * Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *
> reading in captured ivs, snap headers, and samples... done
> total packets: 5983953
> calculating ksa probabilities...
> 0: 36/768 keys (!)
> 1: 4983/131328 keys (!)
> 2: 7444/197376 keys (!)
> 3: 7474/197120 keys (!)
> 4: 12368/328703 keys (!)
> 5: 12395/328192 keys (!)
> 6: 17346/459520 keys (!)
> 7: 17277/459264 keys (!)
> 8: 22171/590592 keys (!)
> 9: 22289/590336 keys (!)
> 10: 27145/721664 keys (!)
> 11: 27136/721408 keys (!)
> 12: 32091/852736 keys (!)
> (!) insufficient ivs, must have > 60 for each key (!)
> (!) probability of success for each key with (!) < 0.5 (!)
> 
> It then begins sending out a whole bunch of periods.  Even though it doesn't
> have enough IVS, I let it run for a week, but it did not find anything.
> 
> Anyone have any suggestions on why I'm not seeing enough weak packets?
> Management has asked me to demonstrate why WEP is weak and this certainly
> isn't helping my case.
> 
> Thanks!
> 
> Brian DeLine
> 
> 
> _______________________________________________
> Bat mailing list
> [email protected]
> http://lists.dachb0den.com/mailman/listinfo/bat
>