I have a cap file in which i have lots of 802.11 packets encrypted with WEP key. The problem is lots of Chaff packets of WEP is included in that. I want to remove the Chaff packets and crack the key. Can anybody tell me a tool or any method to remove the Chaff packets? Thanks in advance.
There is a utility called airdecloak-ng which is supposed to do just that, but I have never used it.
According to its man page:
It is part of the aircrack-ng suite of tools.
You are mistaken chaff packets are sent by tools like aircrack-ng to force WEP to transmit more IV collisions and thus break the key faster.
IDS's like Snort has rule-sets to detect chaff packets. But your looking for the opposite, your looking for aircrack-ng. You can use the ivstool to convert pcap files. Although you will probably be more successful starting the attack from scratch because you can inject chaff packets which greatly speeds up the process.
|show 1 more comment|