07-25-2013, 04:26 PM
Hello, i have a problem. Cant convert my .CAP file. File works fine in aircrack, but aircrack dont have GPU acceleration. When i trying to convert file online it says "no valid handshakes found".
07-25-2013, 04:26 PM
07-25-2013, 05:08 PM
Extracting handshake from pcap dumps is a tricky process. Technically speaking, just 2 out of the 4 frames - 2) and 3) - are enough to get the needed data (packet 3) should have by specification the ANonce), thus even without frames 1 and 4, provided that you know the SSID (from beacon or probe response frame) - you should be good to go.
Now there are quite a lot of corner cases unfortunately. Frame 3) may not have the ANonce and that would not break the protocol. There is 1/2^32 chance that any of the frames are corrupt yet have the correct CRC which would lead to incorrect handshake even though software happily accepts it. EAP-PSK protocol does not maintain the idea of "context" (e.g each handshake having some kind of unique ID), thus overlapping authentications may confuse the software a lot. Additionally, there might be frame retransmits (though replay counter should be then increased to indicate that). However I've heard that behavior may vary (e.g some side might rely on ACK frame and if it gets no ACK frame, it might just resend the same 802.1x frame with the same replay counter value).
Thus it should came as no surprise that different cracking software / pcap conversion tools behave differently.
P.S Perhaps you could have a look at the dump with wireshark and remove some unneeded garbage (using e.g editcap) - this way you may help the convertion tool.
Now there are quite a lot of corner cases unfortunately. Frame 3) may not have the ANonce and that would not break the protocol. There is 1/2^32 chance that any of the frames are corrupt yet have the correct CRC which would lead to incorrect handshake even though software happily accepts it. EAP-PSK protocol does not maintain the idea of "context" (e.g each handshake having some kind of unique ID), thus overlapping authentications may confuse the software a lot. Additionally, there might be frame retransmits (though replay counter should be then increased to indicate that). However I've heard that behavior may vary (e.g some side might rely on ACK frame and if it gets no ACK frame, it might just resend the same 802.1x frame with the same replay counter value).
Thus it should came as no surprise that different cracking software / pcap conversion tools behave differently.
P.S Perhaps you could have a look at the dump with wireshark and remove some unneeded garbage (using e.g editcap) - this way you may help the convertion tool.