Capturing performance is weak in the last version 7 compared to 6.x.x versions

[HITMANO98]

Hi , i noticed less packets been captured on the latest version of hcxdumptool 7.0.1 in comparison with the previous version and other older ones , and to be clear its the same setup debian on a laptop with an mt67 usb and sometimes using the intel one , i tried to use some of the less common parameters just to up the pmkid and handshakes captured but no luck , i just wanted to discuss this with everyone and to make sure is it my side or smt else. thanks

[ZerBea]

That is correct. Starting with v6.3.0 hcdumptool makes much less noise than the older versions. Once we got a PMKID or a handshake, the attack stops immediately. Additional latest version does not store retransmitted (retry bit has been set) MESSAGEPAIRs or PPMKIDs:

I did some tests - and the result was always the same:
running hcxdumptool 6.2.9

$ hcxpcapngtool dump629.pcapng -o 629.22000
EAPOL M1 messages (total)................: 1933
EAPOL M2 messages (total)................: 50
EAPOL M3 messages (total)................: 8
EAPOL M4 messages (total)................: 5
EAPOL M4 messages (zeroed NONCE).........: 5
EAPOL pairs (total)......................: 189
EAPOL pairs (best).......................: 5
EAPOL ROGUE pairs........................: 4
EAPOL pairs written to 22000 hash file...: 5 (RC checked)
EAPOL M12E2 (challenge - ANONCE from M1).: 4
EAPOL M32E2 (authorized - ANONCE from M3): 1
RSN PMKID (total)........................: 36
RSN PMKID (best).........................: 2
RSN PMKID ROGUE..........................: 2
RSN PMKID written to 22000 hash file.....: 2

$ hcxhashtool -i 629.22000
OUI information file..........: /home/zerobeat/.hcxtools/oui.txt
OUI entries...................: 36946
total lines read..............: 7
valid hash lines..............: 7
PMKID hash lines..............: 2
EAPOL hash lines..............: 5

running hcxdumptool 7.0.0 (for the same period as 6.2.9):

$ hcxpcapngtool dump700.pcapng -o 700.22000
EAPOL M1 messages (total)................: 2184
EAPOL M2 messages (total)................: 7
EAPOL M3 messages (total)................: 16
EAPOL M4 messages (total)................: 2
EAPOL M4 messages (zeroed NONCE).........: 2
EAPOL pairs (total)......................: 12
EAPOL pairs (best).......................: 5
EAPOL ROGUE pairs........................: 3
EAPOL pairs written to 22000 hash file...: 5 (RC checked)
EAPOL M12E2 (challenge - ANONCE from M1).: 4
EAPOL M32E2 (authorized - ANONCE from M3): 1
RSN PMKID (total)........................: 15
RSN PMKID (best).........................: 2
RSN PMKID ROGUE..........................: 2
RSN PMKID written to 22000 hash file.....: 2

$ hcxhashtool -i 700.22000
OUI information file..........: /home/zerobeat/.hcxtools/oui.txt
OUI entries...................: 36946
total lines read..............: 7
valid hash lines..............: 7
PMKID hash lines..............: 2
EAPOL hash lines..............: 5

Older versions of hcxdumptool do not remove duplicate MESSAGEPAIRS (retry bit has been set):

EAPOL pairs (total)......................: 189
While latest hcxdumptool does it:
EAPOL pairs (total)......................: 12

Older versions of hcxdumptool do not remove duplicate PMKIDs (retry bit has been set)):

RSN PMKID (total)........................: 36
While latest hcxdumptool does it:
RSN PMKID (total)........................: 15

But all test targets have been attacked sucessfully.

[ZerBea]

That depends on the options. Please take a öook ar help menue.

[Zurtar]

I have checked the help menu, it's just unclear what the default behaviour is. I know there are these modes which cleary explain what they do:

--exitoneapol=<type>      : exit on first EAPOL occurrence:
                             bitmask:
                               1 = PMKID (from AP)
                               2 = EAPOL M1M2M3 (authorized)
                               4 = EAPOL M1M2 (not authorized)
                               8 = EAPOL M1M2ROGUE (not authorized)
                              16 = EAPOL M1

But has the default behaviour changed at all with thew new 7.0 update? You said:

Once we got a PMKID or a handshake, the attack stops immediately.

Does the attack on specific targets stop after a capture is made for that device (based on mac address)? Or is it all or nothing where you have to set one of those flags and shutdown the entire attack rather than it being device specific.

[ZerBea]

exitoneapol terminates hcxdumptool on the first(!) received EAPOL MESSGAE that passed the BPF and matches the conditions:
--exitoneapol=2 -> terminate hcxdumptool if the first EAPOL M1M2M3 frames passed the BPF.

hcxdumptool can be controlled completely by BPF (incoming frames on which hcxdumptool should respond).
The options mentioned in help are additional. They cover cases which are not supported/covered by BPF.

When using exitoneapol it is mandatory to set a target BPF to a single target.
A good example is here:
#361

• set BPF to target
• set option to terminate if the first handshake/pmkid from the target has passed the BPF

I use it to run adapter tests.

[Zurtar]

I see thank you. I've used the BPF before to do something similar, I guess I can setup scripts to exit on the first capture and then generate a new BPF with that target excluded before launching the attack again.

[ZerBea]

You're welcome.

Doing this by a script is fine. There are many ways to do it. Either as you mentioned it (exclude script & options) or include script & options.
It is also a good idea to increase the stay time on the channel and to limt the scan list to channels the targets are using.