Jump to content

Handshake capture only grabbing half the packets


ExR90
 Share

Recommended Posts

Just got my Mark 7 and got the setup done. I am upgraded to 1.02. I do a 30 second scan and find my test AP SSID. Verify the MAC matches the expected AP. I can see my test client as a child of that AP in the list view as expected. I then turn on Capture Handshake for that AP. Then deauth my test client, which it DOES kick it off properly. The client reconnects.

I wait awhile for the handshake to show up in the gui, which says it's a partial. I download the capture and open in wireshark and indeed it says it has 2/4 packets. I have repeated this test several times and get the same thing each time.

Any idea what's going on?

Link to comment
Share on other sites

On 3/4/2021 at 12:25 AM, ExR90 said:

Just got my Mark 7 and got the setup done. I am upgraded to 1.02. I do a 30 second scan and find my test AP SSID. Verify the MAC matches the expected AP. I can see my test client as a child of that AP in the list view as expected. I then turn on Capture Handshake for that AP. Then deauth my test client, which it DOES kick it off properly. The client reconnects.

I wait awhile for the handshake to show up in the gui, which says it's a partial. I download the capture and open in wireshark and indeed it says it has 2/4 packets. I have repeated this test several times and get the same thing each time.

Any idea what's going on?

Is it possible one side or the other is too far away from your Pineapple? If so, you won't be able to see packets for that device...

Link to comment
Share on other sites

I got my mark7 a couple of weeks ago and it does take awhile to get handshakes but I am getting them. I thought it was broke too, but left it on and came back and had two full. I have gotten a part handshake and then in the next 15 mins get the full one. Also remember some devices may stay on the network for awhile before they jump off and on for you to capture the handshake.

Link to comment
Share on other sites

Devices were quite close to each other, all within 25 feet with only 1 drywall wall in between. I will try letting the pineapple roll longer and see what it comes up with, as all my tests were very "short", just a few minutes before I would turn off the function.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...