When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of 20s, small DH keys and no nacks, but I guess the delay could be much shorter for such a router.

What do you say about default value of 1s and what approach would you - and generally do you prefer?

  • isn't it up to each individual router, firmware, and situation?
    – schroeder
    Commented Feb 18, 2016 at 20:40
  • I am very new to this matter and looking for some experiences. I wonder how to recognize which settings fit the situation best to successful and optimized offense. With parameters as above I get WARNING: Detected AP rate limiting message which persist even with longer delay between pin attempts. I've tried to ignore locks state I don't think that it really helps. Commented Feb 18, 2016 at 21:03
  • I would say the router might have blocked my MAC after some attempts... Commented Feb 18, 2016 at 21:11

1 Answer 1


The WPS PIN vulnerability is an online brute-force attack: you make a guess at the PIN, and the router tells you if it's correct or not. Because of this, the limiting factor for attack speed is how fast the router is willing to talk to you.

You can speed things up slightly by using small DH values to reduce the amount of computation the router needs to perform, and by reducing how long you wait between guesses, but if the router is rate-limiting you, there's not much you can do.

  • Is there any way how can I keep changing my MAC and checking WPS pins? Commented Feb 18, 2016 at 22:00
  • You can try changing your MAC, but it shouldn't make any difference to the router because it's so easy to do.
    – Mark
    Commented Feb 18, 2016 at 22:16
  • I'll try tomorrow (+1 GMT). Commented Feb 18, 2016 at 22:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .