WPA PSK Crack w/ "Cloaking"

[SupaRice]

So, I've followed the directions in the show notes for episode 3x06 on cracking WPA. There is one thing that wasn't mentioned, that is if the ESSID is "cloaked" you have to include the ESSID in your aircrack-ng

http://man.cx/aircrack-ng(1)

-e <essid>

Select the target network based on the ESSID. This option is

also required for WPA cracking if the SSID is cloacked.

So I've been trying to crack my setup at home. I have a Cisco AP with two ESSID's. WPA PSK for one ESSID which is cloaked, ESSID is "homenet". And then there is a second ESSID that is open with no encryption or authentication, ESSID "guestnet".

Kismet shows the BSSID, and shows packets count continually rising. And I have 1 client connected to the AP via the cloaked and encrypted ESSID of "homenet". The problem is that Kismet shows ESSID "guestnet" and then "homenet" will blip up for just a second under the same line and then go back to "guestnet". For my testing that's OK, because I know the ESSID I want to capture but I think it's weird or maybe I'm just not doing something right. I looked and there doesn't seem to be a way to get airodump-ng to filter based on ESSID, it will only filter on BSSID. Am I wrong?

The big problem is that airodump-ng does the same thing as Kismet with the ESSID's, it will constantly show "guestnet" (which nobody is connected to) and then it will flash "homenet" up every so often. It does show me capture the WPA handshake, but then when I use aircrack-ng it doesn't find the PSK even though I've placed it in the file.

Ideas? I'm confused.

[SomeoneE1se]

use kismet for find them and just watch carefully

also I suggest submiting a bug report too, this could be a bug, or maybe a feature that could be added