Weak packets: Airsnort vs. Kismet

R4Z13L · 06-17-2003

Hi folks!
At the moment I'm trying to crack the wep key of my home wlan. I'm runnning kismet and airsnort on my notebook, both of them are capturing weak packets, but kismet gets more than airsnort...
So what is the difference between the weak packets kismet gets and the interesting packets airsnort gets...???

btw: Can anyone tell me an efficient method of creating weak packets in a wlan...?

nashr · 06-17-2003

This is a great test. I hope you plan to document and share your results. I've very eager to hear what you learn.

agentgrn · 06-17-2003

Quote:

Originally posted by R4Z13L
btw: Can anyone tell me an efficient method of creating weak packets in a wlan...?

AFAIK, weak packets are chosen in a random fashion by the hardware...so there's no way to generate weak keys per se without generating a ton of traffic. That's why some new firmwares avoid weak keys...making RC4 a pretty tough nut to crack...though not impossible.

JimmyPopAli · 06-17-2003

Kismet doesn't differentiate between duplicate weak IV's. Airsnort does. So you could have 100 weak IVs in Kismet and get less when you open that same file in Airsnort.

R4Z13L · 06-17-2003

Another problem might be kismet's channel hopping mode... Normally I start kismet_monitor -H -O -n, but these options might decrease the amount of captured packets on the one channel the access point is running on, so airsnort does not get all the weak packets if it is running simultaneously... I'll try kismet_monitor -c <#channel> next time and post possible differences...

TheSovereign · 06-17-2003

im currently in teh process of building a mosix cluster in order to use dwepcrack brute force on 128 bit wep

when its completed i will post the start time and end time

06-17-2003	#1 (permalink)
R4Z13L Registered Member Join Date: Apr 2003 Location: Munich Posts: 10	Weak packets: Airsnort vs. Kismet Hi folks! At the moment I'm trying to crack the wep key of my home wlan. I'm runnning kismet and airsnort on my notebook, both of them are capturing weak packets, but kismet gets more than airsnort... So what is the difference between the weak packets kismet gets and the interesting packets airsnort gets...??? btw: Can anyone tell me an efficient method of creating weak packets in a wlan...? __________________ Are you sure you've got no wireless access at home?!

06-17-2003	#2 (permalink)
nashr Uber Geek Join Date: Aug 2002 Location: Virginia Posts: 1,615	Great test! This is a great test. I hope you plan to document and share your results. I've very eager to hear what you learn. __________________ Help! I've been Simpsonized!

06-17-2003	#5 (permalink)
R4Z13L Registered Member Join Date: Apr 2003 Location: Munich Posts: 10	Another problem might be kismet's channel hopping mode... Normally I start kismet_monitor -H -O -n, but these options might decrease the amount of captured packets on the one channel the access point is running on, so airsnort does not get all the weak packets if it is running simultaneously... I'll try kismet_monitor -c <#channel> next time and post possible differences... __________________ Are you sure you've got no wireless access at home?!

06-17-2003	#6 (permalink)
TheSovereign Master of the universe Join Date: Jun 2002 Location: chicago Posts: 658	im currently in teh process of building a mosix cluster in order to use dwepcrack brute force on 128 bit wep when its completed i will post the start time and end time __________________ SO SAYS TheSovereign

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

06-17-2003	#4 (permalink)
JimmyPopAli Registered Member Join Date: Apr 2002 Location: Washington the state Posts: 242	Kismet doesn't differentiate between duplicate weak IV's. Airsnort does. So you could have 100 weak IVs in Kismet and get less when you open that same file in Airsnort.