[Wep Ska Help :)]

To give some background I have successfully crack WEP Open, WPA, and WPS but I seem to be a noob when it comes to WEP SKA.

The problem I am encountering is when I capture the auth packet.

In airpodump-ng once the client authenticates I receive: Broken SKA instead of handshake Captured.

I looked it up some and it said to prevent broken ska packages to spoof the client mac address.

I have done that and am still receiving broken ska. I'm including output from airodump-ng and ifconfig.

airodump-ng -c 1 --bssid 00:21:2F:39:C4:0C -w keyfile mon0:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE detection-run SYSTEM "http://kismetwireless.net/kismet-3.1.0.dtd">

<detection-run kismet-version="airodump-ng-1.0" start-time="Sun Apr 1 18:48:38 2012">

<wireless-network number="1" type="infrastructure" first-time="Sun Apr 1 18:48:38 2012" last-time="Sun Apr 1 18:53:17 2012">

<SSID first-time="Sun Apr 1 18:48:38 2012" last-time="Sun Apr 1 18:53:17 2012">

<type>Beacon</type>

<max-rate>54.000000</max-rate>

<packets>2498</packets>

<beaconrate>10</beaconrate>

<encryption>WEP </encryption>

<essid cloaked="false">airlink101</essid>

</SSID>

<BSSID>00:21:2F:39:C4:0C</BSSID>

<manuf>Phoebe Micro Inc.</manuf>

<channel>1</channel>

<freqmhz>2412 6034</freqmhz>

<maxseenrate>54000</maxseenrate>

<packets>

<LLC>2498</LLC>

<data>760</data>

<crypt>0</crypt>

<total>6034</total>

<fragments>0</fragments>

<retries>0</retries>

</packets>

<datasize>0</datasize>

<wireless-client number="1" type="established" first-time="Sun Apr 1 18:48:42 2012" last-time="Sun Apr 1 18:53:11 2012">

<client-mac>E0:B9:BA:5B:44:E0</client-mac>

<client-manuf>Apple, Inc.</client-manuf>

<channel>1</channel>

<maxseenrate>54.000000</maxseenrate>

<packets>

<LLC>0</LLC>

<data>0</data>

<crypt>0</crypt>

<total>821</total>

<fragments>0</fragments>

<retries>0</retries>

</packets>

<snr-info>

<last_signal_dbm>-23</last_signal_dbm>

<last_noise_dbm>0</last_noise_dbm>

<last_signal_rssi>-23</last_signal_rssi>

<last_noise_rssi>0</last_noise_rssi>

<min_signal_dbm>-23</min_signal_dbm>

<min_noise_dbm>0</min_noise_dbm>

<min_signal_rssi>1024</min_signal_rssi>

<min_noise_rssi>1024</min_noise_rssi>

<max_signal_dbm>-23</max_signal_dbm>

<max_noise_dbm>0</max_noise_dbm>

<max_signal_rssi>-23</max_signal_rssi>

<max_noise_rssi>0</max_noise_rssi>

</snr-info>

<cdp-device></cdp-device>

<cdp-portid></cdp-portid>

</wireless-client>

<snr-info>

<last_signal_dbm>-3</last_signal_dbm>

<last_noise_dbm>0</last_noise_dbm>

<last_signal_rssi>-3</last_signal_rssi>

<last_noise_rssi>0</last_noise_rssi>

<min_signal_dbm>-3</min_signal_dbm>

<min_noise_dbm>0</min_noise_dbm>

<min_signal_rssi>1024</min_signal_rssi>

<min_noise_rssi>1024</min_noise_rssi>

<max_signal_dbm>-3</max_signal_dbm>

<max_noise_dbm>0</max_noise_dbm>

<max_signal_rssi>-3</max_signal_rssi>

<max_noise_rssi>0</max_noise_rssi>

</snr-info>

<bsstimestamp>0</bsstimestamp>

<cdp-device></cdp-device>

<cdp-portid></cdp-portid>

</wireless-network>

</detection-run>

ifconfig mon0:

mon0 Link encap:UNSPEC HWaddr E0-B9-BA-5B-44-E0-00-00-00-00-00-00-00-00-00-00

UP BROADCAST NOTRAILERS RUNNING PROMISC ALLMULTI MTU:1500 Metric:1

RX packets:294562 errors:0 dropped:23075 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:18673664 (18.6 MB) TX bytes:0 (0.0 B)

Any help would be greatly appreciated!

Thanks

PS

One thing I have just noticed is that I neglected to run the arp replay attack before de-authing the client.

Would not performing the arp replay first affect my ability to capture the handshake?

Any input is greatly appreciated!