Re: dwepdump, no output and "-a" problem

Al,

On 4/17/03 9:52, "[email protected]" <[email protected]> wrote:

> I've had no success yet in using DWEPDUMP in trying to collect
> packets in order to "crack" my home network's WEP keys.  I always
> end up wiht a 0 or 24 byte dump file even after days or running
> it with confirmed traffic between my 802.11b AP and Client.
> I also get the "illegal option --a" problem.  I've spent a couple
> weeks figthing with it and I've read through all the postings
> here in BAT and any related solutions I've found have not yet
> solved my problem (hence my posting of this new request for help)
> 
> I've made sure that my wi0 is up and properly set to monitor
> mode (prism2ctl wi0 -m, ifconfig wi0 up, wicontrol -p 3 -f [my
> channel]).  I've tested with Dstumbler and it works (I can see
> many AP's including mine).  However, Dstumblre does NOT work
> with the "-o" option even though my Prism2 card is in monitor
> mode (I find this strange and suspectful).  I've also tried using
> Prism2dump and I get no dump showing up on the screen.  My guess
> is that it seems something is not right with Monitor mode and
> I don't know what it is.  My FreeBSD machine can otherwise connect
> to my WEP enable AP without any problem so I know the hardware
> and basic wi driver fuctions are working properly.

What it seems like is somehow your card isn't getting into monitor mode..
The only thing that could be causing this is if:

1. You're using a card that doesn't support monitor mode.
2. The driver either isn't patched for monitor mode, or doesn't properly
recognize the card as being able to do monitor mode.
3. Somehow the card isn't being setup properly in userland.

> Here's my setup:
> 802.11b AP - FreeBSD 4.7 server with NETGEAR MA401 in AP mode
> (wicontrol -p 6), 64 bit WEP enable (I've also tested by listening
> in on my Neighbors Linksys AP with WEP aslo with the same results)
> 802.11b Client - Various NIC's on various Win OS'es (Lucent Wavelan
> Silver, Nortel/Spect24, Dlink DWL-650)
> 802.11b 64bit WEP test traffic - File transfers using FTP, SFTP,
> windows file sharing, HTTP, ICMP using various sizes of packet
> (10-1500 Bytes)
> Dwepdump v0.2 machine- FreeBSD 4.7 non-patched wi drivers AND
> I've also tried FreeBSD 4.4 with source mod patched wi driver
> and succesfully rebilt kernel.  I've used two differnt Prism2
> Cards:  Netgear MA401 and Dlink DWL-650 (firmware v1.03.05)

I'm pretty sure that the DWL-650 should work properly for doing the capture.
FreeBSD 4.7 should have the patches in the default system, so all you should
need to do with 4.7 is install bsd-airtools from the ports tree. After that,
you should be able to put it into monitor mode by:

ifconfig wi0 up
wicontrol wi0 -p 3 -f <channel>
prism2ctl wi0 -m

Then, just run prism2dump wi0 and see if you can see any packets... If you
can, then proceed and run dwepdump and capture the packets for cracking.

Although, if you're having trouble getting dstumbler -o to work, I think
it's something wrong with the card or the driver. One last thing you might
want to try is setting the card into port 5 mode and see if you get
anything:

ifconfig wi0 up
wicontrol wi0 -F 1 -p 5 -f <channel>
prism2dump wi0 -p

(make sure you don't run prism2ctl)
This will put the card into pseudo-hostap mode that'll let you listen to
packets and do injection and stuff.. It should be virtually the same as
monitor mode for the most part..

> I've read many success storied her in BAT with similar setups
> so I know I must be able to get mine working.  I'm hopefull that
> I've just missed a simple setting somewhere but just need some
> help from BAT in finding it.
> 
> Thank you in advance for taking the time to read this (and hopfully
> respond).
> Al - [email protected]

Let me know if you have any further luck with porttype 5,.. If you're still
having problems, send some detailed logs from your dmesg output for the
cards and any more information you can throw together on what's going on..

Good luck,
-h1kari