RE: Re: dwepdump, no output and "-a" problem

SOLUTION FOUND!  IRQ Conflict in PC Card Slot 1.
After further testing as recommend by h1kari I focused on the
hardware setup (I posted my tests and results as a new thread
accidently).  As it turns out I had an IRQ conflict when using
both PC Card slots on my laptop.  It was a simple matter of reading
the pccard.conf file and finding out that it is recommded to
NOT assign IRQ 5 in systems that have built-in sound cards (i.e.
most laptops).  With my Prism card in monitor mode I am now able
to successfully run "dstumbler -o", prism2dump.  I still have
the "-a illegal option" issue in dwepdump but it still seems
to collect all packet regardless of the error.

Last question:  What does the "-F 1" optionin wicontrol do?

Regards,
Al.

>--- Original Message ---
>From: h1kari <[email protected]>
>To: bat <[email protected]>
>Date: 4/17/03 3:47:36 PM
>
Al,
>
>On 4/17/03 9:52, "[email protected]" <[email protected]> wrote:
>
>> I've had no success yet in using DWEPDUMP in trying to collect
>> packets in order to "crack" my home network's WEP keys.  I
always
>> end up wiht a 0 or 24 byte dump file even after days or running
>> it with confirmed traffic between my 802.11b AP and Client.
>> I also get the "illegal option --a" problem.  I've spent a
couple
>> weeks figthing with it and I've read through all the postings
>> here in BAT and any related solutions I've found have not
yet
>> solved my problem (hence my posting of this new request for
help)
>> 
>> I've made sure that my wi0 is up and properly set to monitor
>> mode (prism2ctl wi0 -m, ifconfig wi0 up, wicontrol -p 3 -f
[my
>> channel]).  I've tested with Dstumbler and it works (I can
see
>> many AP's including mine).  However, Dstumblre does NOT work
>> with the "-o" option even though my Prism2 card is in monitor
>> mode (I find this strange and suspectful).  I've also tried
using
>> Prism2dump and I get no dump showing up on the screen.  My
guess
>> is that it seems something is not right with Monitor mode
and
>> I don't know what it is.  My FreeBSD machine can otherwise
connect
>> to my WEP enable AP without any problem so I know the hardware
>> and basic wi driver fuctions are working properly.
>
>What it seems like is somehow your card isn't getting into monitor
mode..
>The only thing that could be causing this is if:
>
>1. You're using a card that doesn't support monitor mode.
>2. The driver either isn't patched for monitor mode, or doesn't
properly
>recognize the card as being able to do monitor mode.
>3. Somehow the card isn't being setup properly in userland.
>
>> Here's my setup:
>> 802.11b AP - FreeBSD 4.7 server with NETGEAR MA401 in AP mode
>> (wicontrol -p 6), 64 bit WEP enable (I've also tested by listening
>> in on my Neighbors Linksys AP with WEP aslo with the same
results)
>> 802.11b Client - Various NIC's on various Win OS'es (Lucent
Wavelan
>> Silver, Nortel/Spect24, Dlink DWL-650)
>> 802.11b 64bit WEP test traffic - File transfers using FTP,
SFTP,
>> windows file sharing, HTTP, ICMP using various sizes of packet
>> (10-1500 Bytes)
>> Dwepdump v0.2 machine- FreeBSD 4.7 non-patched wi drivers
AND
>> I've also tried FreeBSD 4.4 with source mod patched wi driver
>> and succesfully rebilt kernel.  I've used two differnt Prism2
>> Cards:  Netgear MA401 and Dlink DWL-650 (firmware v1.03.05)
>
>I'm pretty sure that the DWL-650 should work properly for doing
the capture.
>FreeBSD 4.7 should have the patches in the default system, so
all you should
>need to do with 4.7 is install bsd-airtools from the ports tree.
After that,
>you should be able to put it into monitor mode by:
>
>ifconfig wi0 up
>wicontrol wi0 -p 3 -f <channel>
>prism2ctl wi0 -m
>
>Then, just run prism2dump wi0 and see if you can see any packets...
If you
>can, then proceed and run dwepdump and capture the packets for
cracking.
>
>Although, if you're having trouble getting dstumbler -o to work,
I think
>it's something wrong with the card or the driver. One last thing
you might
>want to try is setting the card into port 5 mode and see if
you get
>anything:
>
>ifconfig wi0 up
>wicontrol wi0 -F 1 -p 5 -f <channel>
>prism2dump wi0 -p
>
>(make sure you don't run prism2ctl)
>This will put the card into pseudo-hostap mode that'll let you
listen to
>packets and do injection and stuff.. It should be virtually
the same as
>monitor mode for the most part..
>
>> I've read many success storied her in BAT with similar setups
>> so I know I must be able to get mine working.  I'm hopefull
that
>> I've just missed a simple setting somewhere but just need
some
>> help from BAT in finding it.
>> 
>> Thank you in advance for taking the time to read this (and
hopfully
>> respond).
>> Al - [email protected]
>
>Let me know if you have any further luck with porttype 5,..
If you're still
>having problems, send some detailed logs from your dmesg output
for the
>cards and any more information you can throw together on what's
going on..
>
>Good luck,
>-h1kari
>
>_______________________________________________
>Bat mailing list
>[email protected]
>http://lists.dachb0den.com/mailman/listinfo/bat
>