dwepcrack doesn't

"Tye F. Hammerle" <[email protected]> Mon, 24 Feb 2003 19:33:38 -0600
Newsgroups gmane.network.wireless.bsd.airtools
Message-ID <[email protected]>
I'm working on cracking wep keys with OpenBSD 3.2 using the bsd-airtools 
package.  I've gathered more than enough packets according to what I've 
read yet it seems uncrackable.

I've got a Cisco 340 Access point setup with 40-bit wep (key = 
0101010101 ) no tkip or mic enabled. I have another PC setup with a 
Cisco 350 wireless card. The PC uses a batch file to copy and delete a 
65mb file to a server across the wireless network. It's been running for 
a couple of days now and here's what I've got.;


#./dwepdump  -w wi0 logfile

* dwepdump v0.2 by h1kari <[email protected]> *
* Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *

starting pcap capture loop...
 device: wi0
 logfile: logfile

0:6c 1:6589 2:9e5d :: 3183449


According to the above I've got 6c (102 dec) weak packets, well over the 
40 (60 dec) suggested as necessary in the docs.

Now lets see if we can crack it;

#./dwepcrack  -w   logfile

* dwepcrack v0.4 by h1kari <[email protected]> *
* Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *

reading in captured ivs, snap headers, and samples... done
total packets: 174324

calculating ksa probabilities...
 0: 8/768 keys (!)
 1: 2048/131328 keys (!)
 2: 3076/197376 keys (!)
 3: 3076/197120 keys (!)
 4: 5379/328703 keys (!)

(!) insufficient ivs, must have > 60 for each key (!)
(!) probability of success for each key with (!) < 0.5 (!)

warming up the grinder...
 packet length: 40
 init vector: 01:03:04
 default tx key: 0

progress: ................................................


Yet when I run Dwpecrack, it gets nowhere. I've tried -f 1 through 9. I 
also don't understand the "must have > 60 for each key" what is the n:x 
counter (x) for? I thought that was the weak key counter and I've got 6c 
which is way over the 60.  I figure I'm confused.

Before I got this output I ran another capture for about a day getting 
over 20 on (x). Didn't crack. I ran dwepcrack -b and brute forced the 
key in 16 hours. (my laptop is a PII-333)

So, I'm looking to find out what I should be expecting to see for 
numbers from dwepdump. Also,  how much of a given is it that once you 
have enough weak keys you can crack the key?  Based on what the docs 
tell me and the little I think I have learned, I am getting enough that 
dwepcrack should have cracked the key.

I've read several lists where the people there are saying that there is 
a significant difference between cracking a real live network verses a 
lab test network. Supposedly the real network cracks alot easier. 
Interesting.

Where am I going wrong?

Tye