Re: how long does wep crack take

Hi Matthias,

Don't worry about your english, you're doing great. You're way ahead of 
me, I can't write or read any German!

So you can compare results this is what my 24hr capture run looked like;

# ./dwepdump -w wi0 netgear1

* dwepdump v0.2 by h1kari <[email protected]> *
* Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *

starting pcap capture loop...
  device: wi0
  logfile: netgear1

0.31 1:2436 2:35c4 :: 1158813

stopping pcap capture loop...


netgear1 file is 64396278 bytes


# ./dwepcrack -w -f4 /usr/local/sbin/netgear1

* dwepcrack v0.4 by h1kari <[email protected]> *
* Copyright (c) Dachb0den Labs 2002 [http://dachb0den.com] *

reading in captured ivs, snap headers, and samples... done
total packets: 59077

calculating ksa probabilities...
  0: 33/768 keys (!)
  1: 6069/131328 keys (!)
  2: 6018/197376 keys (!)
  3: 3037/197120 keys (!)
  4: 2991/328703 keys (!)

(!) insufficient ivs, must have > 60 for each key (!)
(!) probability of success for each key with (!) < 0.5 (!)

warming up the grinder...
  packet length: 44
  init vector: 19:e8:69
  default tx key: 0

progress: 
......................................................................

wep keys successfully cracked!
  0: c1:fe:21:01:bc *
done.


Promiscuous mode and monitor mode are different from what I see. 
Promiscuous mode makes the card listen to all the network traffic, like 
tcp, udp, icmp etc whereas monitor mode makes the card listen to all 
radio (rf) traffic. The radio traffic is not necessarily network 
traffic. Things like beacons don't show up in promiscuous mode.

As far as I can tell packet size doesn't seem to matter in what I have 
done so far. The whole key to success is whether or not the wireless 
gear is doing weak iv filtering. If it does, you're unlikely to be able 
to crack it. If it does not, it is simply a matter of time to get enough 
packets.

Tye


[email protected] wrote:
> Hi Tye
> 
> 
>>Hi Matthias,
>>
> 
> 
> 
>>DWL900 is a DLink? I called DLink to find out if they do weak iv 
>>filtering and they told me that they do not. I do not know if that was a 
>>good answer or not. If they are doing weak iv filtering you could 
>>capture packets for a long time and not get enough unique ones. YOu end 
>>up getting alot of duplicate iv's which do not help in cracking. I 
>>experienced this with cisco AP and pc card.  I captured over 200mb of 
>>packets and could not crack any keys.
>>
> 
> 
> Yes it is a Dlink product, i read the manual (which is very crappy) and
> search on the net, but did not find an answer if it does iv filtering or not. 
> 
> 
>>What is your test setup?  I used a laptop copying a 65mb ISO to a server 
>>on the wired network. I used a batch file to copy/delete/copy again the 
>>file. I did this until I had enough weak iv's. It took about 24 hours.
>>
> 
> 
> I do mostly external traffic from one of the workstations in the wireless
> net (edonkey, leech linux isos etc..) i habe over 2gb traffic from this
> workstationen, and captured "700" packets with dwepdump! That cannot be correct. I
> also tried ftp'ing big files in the local net (600MB iso). Is it better to
> have a lot of small packets?
>  
> 
>>I do not believe promiscusous mode matters when the card is in monitor
>>mode.
>>
> 
> 
> i think promiscuos and monitor mode is the same thing, is this wrong? well
> at least promiscuos mode on a ethernet device does actually the same like the
> monitor mode on a wireless device. 
>  
> 
>>I used a Netgear MA-402 Ap and MA401 pcmica card and captured about 70 
>>mb of packets with weak iv's.  It took dwepcrack about 30 seconds to 
>>load the packets and 3 seconds to crack the WEP key.
>>
>>Tye
> 
> 
> regards matthias
> 
> p.s. i am sorry for my crappy english but i am from germany
>