Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I have a cap file in which i have lots of 802.11 packets encrypted with WEP key. The problem is lots of Chaff packets of WEP is included in that. I want to remove the Chaff packets and crack the key. Can anybody tell me a tool or any method to remove the Chaff packets? Thanks in advance.

share|improve this question

2 Answers

up vote 0 down vote

There is a utility called airdecloak-ng which is supposed to do just that, but I have never used it.

According to its man page:

Airdecloak-ng is a tool that removes wep cloaking from a pcap file. Some WIPS (actually one) can actively "prevent" cracking a WEP key by inserting chaff (fake wep frames) in the air to fool aircrack-ng.

It is part of the aircrack-ng suite of tools.

share|improve this answer
up vote 1 down vote

You are mistaken chaff packets are sent by tools like aircrack-ng to force WEP to transmit more IV collisions and thus break the key faster.

IDS's like Snort has rule-sets to detect chaff packets. But your looking for the opposite, your looking for aircrack-ng. You can use the ivstool to convert pcap files. Although you will probably be more successful starting the attack from scratch because you can inject chaff packets which greatly speeds up the process.

share|improve this answer
It's about WEP cloaking. – narayan May 15 '11 at 2:43
1  
@narayan but wep breaks in 3-5 minutes with aircrack-ng, this question was asked 22 hours ago. What is the problem? – Rook May 15 '11 at 16:27
It's not about cracking the WEP. It is about learning the techniques to remove the Chaff packets from the cap file. – narayan May 17 '11 at 13:58
@narayan okay so then your being attacked and you have packet dump which contains the chaff packets injected by the attacker. Then you can use a Wireless ids WIDS, to detect the injected chaff packets. I'm 90% sure snort has rules to detect these types of attacks. – Rook May 17 '11 at 14:59
No, The correct analogy is like I am sending the Chaff packets encrypted with different WEP keys in air. So When an attacker captures WEP packets of my network. he will get, he will get confused. tools will hardly help here because there are multiple keys involved. Now here I want to know, what options the attacker have to filter those packets and get my actual WEP packets? – narayan May 19 '11 at 18:15
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.