Re: Not enough weak keys

Brian DeLine wrote:

> I captured 2GB of traffic and I'm not seeing nearly enough weak keys.
>
> The access point is a Linksys BEFW11S4 running 128bit WEP and current firmware.
> I'm collecting raw dumps with a Cisco Aironet 350 card (in monitor mode) using Kismet under Linux.

Linksys is definitely doing weak IV filtering, meaning (as David notes) you'll need a lot more packets because the easy always-applicable weak IVs get filtered out.
Another possibility is you have no "correct" weak IVs which apply to the first or second key bytes, in which case you'll never get a solution -- if that's the case, and you
have enough weak IVs in the later bytes, you can modify dwepcrack to allow it to consider all possible values for the first couple of key bytes.