aircrack only collects 256 IVs on D-Link AP, works fine on Cisco AP..??
Posted: Mon Aug 15, 2005 1:10 am
Hi all,
I'm using version 2.21 of the aircrack suite under SuSE Linux 9.3 (2.6.11.4-21.2), using a Netgear WG511T card (Atheros chipset). While I can perfectly crack my own WEP-key (64 and 128 bits) within a few minutes on a pretty new Cisco Aironet 1200 AP, I got a strange problem at my other, old D-Link DWL-1000AP. On the latter one, airodump never gets more than 256 IVs.
Actually, aireplay successfully injects thousands of ARP requests (I can also see them from within the WLAN using ethereal, including the replies). airodump does also collect all these packets, but the number under "IVs" (usable IVs) only climbs slower and slower and finally stops at 256 IVs. I tried it several times, using captured ARP requests as seed, as well as packets forged using arpforge (and the chopchop attack in advance, which works fine in itself). The symptom is always the same - it can never collect more than 256 IVs. I also tried collecting packets using kismet instead of airodump and then apply aircrack onto it. In this case, aircrack does report thousand of packets, but only 256 usable IVs (at most).
This is really weird because, as mentioned, it works perfectly on the much newer Cisco AP (which is supposed to be more secure than the old D-Link, isn't it?). Am I doing something wrong, or does indeed aircrack not work on some (even old-old-old) APs like the D-Link...?
Thanks in advance for any help! klaymen
I'm using version 2.21 of the aircrack suite under SuSE Linux 9.3 (2.6.11.4-21.2), using a Netgear WG511T card (Atheros chipset). While I can perfectly crack my own WEP-key (64 and 128 bits) within a few minutes on a pretty new Cisco Aironet 1200 AP, I got a strange problem at my other, old D-Link DWL-1000AP. On the latter one, airodump never gets more than 256 IVs.
Actually, aireplay successfully injects thousands of ARP requests (I can also see them from within the WLAN using ethereal, including the replies). airodump does also collect all these packets, but the number under "IVs" (usable IVs) only climbs slower and slower and finally stops at 256 IVs. I tried it several times, using captured ARP requests as seed, as well as packets forged using arpforge (and the chopchop attack in advance, which works fine in itself). The symptom is always the same - it can never collect more than 256 IVs. I also tried collecting packets using kismet instead of airodump and then apply aircrack onto it. In this case, aircrack does report thousand of packets, but only 256 usable IVs (at most).
This is really weird because, as mentioned, it works perfectly on the much newer Cisco AP (which is supposed to be more secure than the old D-Link, isn't it?). Am I doing something wrong, or does indeed aircrack not work on some (even old-old-old) APs like the D-Link...?
Thanks in advance for any help! klaymen