5

I bought an old, used WRT-54G () which strangely enough, was running DD-WRT v24-sp2. Weird what turns up at yard sales.

I want to try the "aircrack-ng" WEP cracking procedure on it. The criteria for success is easy: when "aircrack-ng" delivers me the WEP key.

But what should I see on the DD-WRT side? I have this DD-WRT instance set to write syslog data to another Linux machine on the ethernet (wire) side, so I can see whatever DD-WRT logs. Does any other logging facility exist that I should watch?

Improve this question

3 Answers 3

Reset to default
6

WEP cracking is a function if capturing a lot of traffic and brute forcing the mis-implementation of RC4 and initial vectors (http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy#Flaws). The only thing which may differ from "normal" traffic is the rate. If you are logging all of the authentications and handshakes, you would have to do some statistics on the timing of the events and compare them to a baseline. I do not believe the DD-WRT provide detail system logs of the actual packet traffic that might be useful to also look at.

If you are asking, how to detect a WEP attack on my network, the first response would be - WEP is easily attacked, so expect that if you must use WEP it will be compromised. Alternatively, you could look into Wireless Intrusion Prevention Systems, which could detect what it deems abnormal activity or matches patterns of suspicious activity.

Improve this answer
1
  • I found that DD-WRT, at least, doesn't seem to notice that WEP cracking takes place. You can maybe see an LED flickering more, if you look at the Access Point front panel, but that's about it.
    – Bruce Ediger
    Oct 22, 2012 at 0:57
2

You can't detect whether your WEP key was compromised. The attacks are passive, meaning that they probably won't be visible to you. You'll just have to go by when aircrack-ng delivers you the WEP key.

If anyone else finds this page via Google and who may be thinking of using WEP and trying to build some detectors to detect, from their routers, whether their WEP key has been cracked -- the right answer is:

For goodness sakes, don't use WEP!

WEP is totally, utterly broken. There is no reason to use it these days. Either use an open network, if you don't care about security at all, or use WPA2, if you do.

Improve this answer
2
  • I'm just doing this to see how things work, not to run an Access Point. To crack WEP, the attacker runs "aireplay-ng" in the ARP Replay mode. So the attacker is not entirely passive, is he/she? Can I see the results of the ARP replays?
    – Bruce Ediger
    Aug 29, 2012 at 1:22
  • I know I'm very late to the game, but... running aireplay-ng is optional. If you're patient enough you can gather enough IVs to crack the WEP key simply by sniffing tracking. That is completely passive.
    – MetaFight
    Feb 14, 2016 at 19:26
-1

its aircrack-ng you send arp poisning packets in this IV can be determined you my refer to wikis heaps of open inf

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .