Airodump, resume or not resume ?

Enigma1 · 04-24-2005

HI !

I try to capture IVs with Airodump from a WEP "safed" AP.
After some days, my PC with running Airodump rebooted because off Power loss.
I started Aircrack to see how much IVs there into the .cap file.
Than i restarted Airodump aigain with the same prefix for the .cap file as before.
All seems to work. Airodump seem to resume the .cap file.
A few days later after collecting many new IVs, i start aircrack aigain, but aircrack was only able to show as much IVs into the .cap file that it shows before the "Power off cut".
The .cap file is now much bigger than before the crash, but i seems that Aircrack couldnt get the IVs from this file, that airodump captured after the crash.
Is there any possibillity, to get all of the IVs, that might be into the .cap file ?
To future crashes during sniffing, how can i merge .cap files ?

Thanks

Bernd

flakeys · 04-24-2005

aircrack appends.
unless the file is totally mangled
there are other ways to merge them later.

or buy a ups or use a laptop....

04-24-2005

Look at mergecap.exe from Ethereal directory.

floydmarks · 04-26-2005

i get the same problem. i start airodump (win32 version) and stop it after close to a million iv's and the put them in aircrack but get no key. so i again start airodump and use the same output file name. it gets another half million iv's. i stop airodump, but when i then start aircrack again with the now larger file it still says it finds the same number of iv's as it did before i added to the file.

any ideas?

04-24-2005	#1 (permalink)
Enigma1 Registered Member Join Date: Apr 2005 Posts: 1	Airodump, resume or not resume ? HI ! I try to capture IVs with Airodump from a WEP "safed" AP. After some days, my PC with running Airodump rebooted because off Power loss. I started Aircrack to see how much IVs there into the .cap file. Than i restarted Airodump aigain with the same prefix for the .cap file as before. All seems to work. Airodump seem to resume the .cap file. A few days later after collecting many new IVs, i start aircrack aigain, but aircrack was only able to show as much IVs into the .cap file that it shows before the "Power off cut". The .cap file is now much bigger than before the crash, but i seems that Aircrack couldnt get the IVs from this file, that airodump captured after the crash. Is there any possibillity, to get all of the IVs, that might be into the .cap file ? To future crashes during sniffing, how can i merge .cap files ? Thanks Bernd Last edited by Enigma1 : 04-24-2005 at 06:47 AM.

04-24-2005	#2 (permalink)
flakeys Registered Member Join Date: Apr 2005 Posts: 6	YEs aircrack appends. unless the file is totally mangled there are other ways to merge them later. or buy a ups or use a laptop....

04-26-2005	#4 (permalink)
floydmarks Registered Member Join Date: Apr 2005 Posts: 1	same here... i get the same problem. i start airodump (win32 version) and stop it after close to a million iv's and the put them in aircrack but get no key. so i again start airodump and use the same output file name. it gets another half million iv's. i stop airodump, but when i then start aircrack again with the now larger file it still says it finds the same number of iv's as it did before i added to the file. any ideas?

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

04-24-2005	#3 (permalink)
Flopik Posts: n/a	Look at mergecap.exe from Ethereal directory.