Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm cracking a wpa2-psk wifi with aircrack-ng. After popullating the *cap file I'll apply brute-force with john.

The question is:

What time is it recommend to run airodump-ng before killing it's process?

How many beacons should be there, and how does that affects the brute-force procedure?

share|improve this question
up vote 3 down vote accepted

What you're looking for with cracking WPA-PSKs is handshakes (clients joining the network), so the exact amount of time that you'll need to wait depends on how busy the network is.

As a tip you can run airocrack-ng on the cap files whilst you're capturing traffic and see if there are any handshakes listed for the network that you're interested in.

Also another way to speed things up is to lock airodump-ng onto the channel that the network you're interested in is using (using the --channel switch) as that way it won't hop around all the channels and you'll get more traffic that you're interested in.

Additionally if there are clients on the network but there's not a lot of joining activity you can use a deauthentication attack to speed things along.

share|improve this answer
It's a shame I can't get the mac addresses of the clients connected to that network. I'll try deauthentication – jviotti Dec 27 '12 at 15:28

Bruteforce is completely a matter of Luck and victim's Ignorance . Run airodump for as long as you can and as much time and resources you wanna dedicate .

Regarding Beacons , it doesn't really matter . beacons are just unencrypted announcement packets. They are totally useless for cracking imho .

share|improve this answer

Not directly answer the question but if the access point has WiFi Protected Setup (WPS) enable, then take a look at Reaver. It works by cracking the setup pin which is much much quicker.

There is a further flaw in most access points which halves the attack time too. Worse is that a lot don't even let you turn this feature off.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.