Originally Posted by b0nk

I analysed manually my capture file with ethereal (which is far more useful to analyse packets than tcpdump ), to search for some recurrent patterns.
I had a look at broadcasted queries. I found many packets of 118 & 368 bytes (raw) length.

Originally Posted by b0nk

I found that the usual 68 bytes check (original aireplay source) had a tendency to give non optimal results.

Explanation :

At first, usable IVs received with traffic injection are quite good, but after 50K packets, usable IVs are more and more rare, reaching its limit after some time.
By replaying 118 & 368 bytes packets, this behavior seems to be more tolerent. I think it's certainly has a limit, but possible usable IVs reduces slower than the 68 bytes filter.

I also added 3 features I found useful for aireplay :
- Hexadecimal dump of selected packets
- Possibility to repeat a specific packet
- Set length check manually

More testing is needed, if someone want to try the code, let me know !