Days ago I was dumping handshakes of my APs using airodump-ng. I would later use aircrack-ng to crack them using wordlists which would purposely contain the passphrases. However, I noticed that some handshakes of the same AP cracked while others didn't. I'd recapture the handshake again and again and test, however, not all of them cracked. So I started to inspect them using wireshark and I found no difference between a successfully cracked handshake and a failed one, they both contained:
I once came across a post explaining that in order for a handshake to be healthy and enough for cracking it should contain:
the M2 (a must)
the M3 or the M1 (the M3 is preferred)
and possibly the beacon
So my question is what's the factor that makes a handshake suitable for cracking? Surely the eapol messages are a must but there must be something else judging. It is really inefficient and blind to capture a handshake, try to crack it, and assume the AP is secure just because the cracking failed, maybe the handshake wasn't healthy in the first place.