I've got a TP-Link TL-WN722N wifi adapter which I believe allows monitoring/injection to a network (was reassured by the comments of other users). When I follow a guide by Vulnerableuser I can get to the stage where I am sending deauth packets to the target MAC Address via the AP, but I don't seem to see a a WPA Handshake.

My question is, How long should this deauth approach take to successfully receive the handshake? I understand that there isn't a fixed amount of time for this to occur, but what would this time be on average - a few hours, days, weeks!?

I can confirm that there are devices connected to the network being two desktops, one mobile, and one tablet (mobile and tablet being the ones connected via wifi). Since they are all using the same AP and WPA2 Key, this shouldn't have any effect on when a handshake should take place (can someone please confirm this?).

Any insight to this would be a great help.

4 Answers 4


Usually it takes only few seconds.however, if you're using the card on a virtual machine you might face problems.

I can confirm that the card works (i tried it myself). first time was with Backtrack-5 live boot CD and it worked perfectly, next time was on virtual Kali 2.0 and it didn't work. Just as you described it, the deauth packet goes and nothing happens.

  • So would you recommend me using BT5 over Kali? Feb 26, 2016 at 20:19
  • 1
    I would recommend live\resident OS over virtual one .
    – HSN
    Feb 26, 2016 at 20:25
  • Well I am currently running the live version of Kali from the ISO as it's default user is root, saving me the effort of using sudo all the time. Would that be sufficient? But that is being ran via a virtual machine which may make it not work? Feb 26, 2016 at 20:26
  • What version of Kali are you using ? There has been some reports about problems with wireless attacks on Kali 2.0
    – HSN
    Feb 26, 2016 at 20:38
  • forums.kali.org/…
    – HSN
    Feb 26, 2016 at 20:41

It depends on the number of users on the network. If there isn't anyone using the network you won't get any handshakes.

  • Well since its my home network I can confirm at least three devices connected to the router Feb 26, 2016 at 20:19
  • Please clarify this in the original question.
    – d1str0
    Feb 26, 2016 at 20:20

It will happen pretty quickly most of the time. Open a second terminal and try the de-authenticating client air replay line again and the second time it will work. Also the WPA handshake will show where you view the airodump-ng traffic . so make sure you're checking the right spot


After running the command for deauthenticating a client, if you don't get a wpa handshake in a few seconds or a minutes, terminate the command by pressing ctrl+c. Wait for a few seconds and you should get a wpa handshake . You can see it written on right corner of airodump-ng screen. What happens is that when you continuously keep sending deauthentication packets to the client, sometimes it is not able get reconnect to the access point. So when you terminate the deauthentication command the client reconnects to the access point wpa handshake is a success. It is necessary that a client connects the access point after you have typed the "airodump-ng -c -w -b " command and hit enter, to get a wpa handshake. It might also happen that your luck is very good and a client connects to the access point after you have executed the above command. IF that is the case then you will automatically get a handshake without even deauhenticating an already connected client. Even if now you you are not getting a hand shake the you must check your wireless for injection capabilities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .