When attempting to crack multiple WPA2 handshakes, does Hashcat crack them one at a time? I am assuming this is how it works.
Also, does anyone know of a good way to extract / split the .cap or .hccap file based on handshakes?
wireshark can split cap files
A hccap file only contains one essid. When you convert a cap file into hccap you provide a number corresponding to the essid you wanna crack.
+1 wireshark to "split" your cap file.
If you're on Backtrack, or by chance have aircrack-ng, it has the ability to convert to *.hccap
From
http://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 :
Example working code aircrack .cap conversion to .hccap
Quote:aircrack-ng <out.cap> -J <out.hccap>
Note the -J is a capitol J not lower case j.
*You can select the specific ESSID you want to convert to hccap from the cap file using this method
Yeah, cats cant process multiple networks at the moment, even if they have the same ESSID(salt).