dwepcrack doesn't
"Tye F. Hammerle" <[email protected]> Mon, 24 Feb 2003 19:33:38 -0600
| Newsgroups | gmane.network.wireless.bsd.airtools |
|---|---|
| Message-ID | <[email protected]> |
I'm working on cracking wep keys with OpenBSD 3.2 using the bsd-airtools package. I've gathered more than enough packets according to what I've read yet it seems uncrackable. I've got a Cisco 340 Access point setup with 40-bit wep (key = 0101010101 ) no tkip or mic enabled. I have another PC setup with a Cisco 350 wireless card. The PC uses a batch file to copy and delete a 65mb file to a server across the wireless network. It's been running for a couple of days now and here's what I've got.; #./dwepdump -w wi0 logfile * dwepdump v0.2 by h1kari <[email protected]> * * Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] * starting pcap capture loop... device: wi0 logfile: logfile 0:6c 1:6589 2:9e5d :: 3183449 According to the above I've got 6c (102 dec) weak packets, well over the 40 (60 dec) suggested as necessary in the docs. Now lets see if we can crack it; #./dwepcrack -w logfile * dwepcrack v0.4 by h1kari <[email protected]> * * Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] * reading in captured ivs, snap headers, and samples... done total packets: 174324 calculating ksa probabilities... 0: 8/768 keys (!) 1: 2048/131328 keys (!) 2: 3076/197376 keys (!) 3: 3076/197120 keys (!) 4: 5379/328703 keys (!) (!) insufficient ivs, must have > 60 for each key (!) (!) probability of success for each key with (!) < 0.5 (!) warming up the grinder... packet length: 40 init vector: 01:03:04 default tx key: 0 progress: ................................................ Yet when I run Dwpecrack, it gets nowhere. I've tried -f 1 through 9. I also don't understand the "must have > 60 for each key" what is the n:x counter (x) for? I thought that was the weak key counter and I've got 6c which is way over the 60. I figure I'm confused. Before I got this output I ran another capture for about a day getting over 20 on (x). Didn't crack. I ran dwepcrack -b and brute forced the key in 16 hours. (my laptop is a PII-333) So, I'm looking to find out what I should be expecting to see for numbers from dwepdump. Also, how much of a given is it that once you have enough weak keys you can crack the key? Based on what the docs tell me and the little I think I have learned, I am getting enough that dwepcrack should have cracked the key. I've read several lists where the people there are saying that there is a significant difference between cracking a real live network verses a lab test network. Supposedly the real network cracks alot easier. Interesting. Where am I going wrong? Tye