Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I bought an old, used WRT-54G () which strangely enough, was running DD-WRT v24-sp2. Weird what turns up at yard sales.

I want to try the "aircrack-ng" WEP cracking procedure on it. The criteria for success is easy: when "aircrack-ng" delivers me the WEP key.

But what should I see on the DD-WRT side? I have this DD-WRT instance set to write syslog data to another Linux machine on the ethernet (wire) side, so I can see whatever DD-WRT logs. Does any other logging facility exist that I should watch?

share|improve this question
add comment

3 Answers 3

up vote 5 down vote accepted

WEP cracking is a function if capturing a lot of traffic and brute forcing the mis-implementation of RC4 and initial vectors (http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy#Flaws). The only thing which may differ from "normal" traffic is the rate. If you are logging all of the authentications and handshakes, you would have to do some statistics on the timing of the events and compare them to a baseline. I do not believe the DD-WRT provide detail system logs of the actual packet traffic that might be useful to also look at.

If you are asking, how to detect a WEP attack on my network, the first response would be - WEP is easily attacked, so expect that if you must use WEP it will be compromised. Alternatively, you could look into Wireless Intrusion Prevention Systems, which could detect what it deems abnormal activity or matches patterns of suspicious activity.

share|improve this answer
    
I found that DD-WRT, at least, doesn't seem to notice that WEP cracking takes place. You can maybe see an LED flickering more, if you look at the Access Point front panel, but that's about it. –  Bruce Ediger Oct 22 '12 at 0:57
add comment

You can't detect whether your WEP key was compromised. The attacks are passive, meaning that they probably won't be visible to you. You'll just have to go by when aircrack-ng delivers you the WEP key.

If anyone else finds this page via Google and who may be thinking of using WEP and trying to build some detectors to detect, from their routers, whether their WEP key has been cracked -- the right answer is:

For goodness sakes, don't use WEP!

WEP is totally, utterly broken. There is no reason to use it these days. Either use an open network, if you don't care about security at all, or use WPA2, if you do.

share|improve this answer
    
I'm just doing this to see how things work, not to run an Access Point. To crack WEP, the attacker runs "aireplay-ng" in the ARP Replay mode. So the attacker is not entirely passive, is he/she? Can I see the results of the ARP replays? –  Bruce Ediger Aug 29 '12 at 1:22
add comment

its aircrack-ng you send arp poisning packets in this IV can be determined you my refer to wikis heaps of open inf

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.