You can do this running hcxpcapngtool without options to save files:
Than compare the results:
EAPOL pairs (best).......................: 27
vs
EAPOL pairs (best).......................: 29
I can't recommend to edit a hcxdumptool pcapng file, because this will remove important informations!
$ hcxdumptool --help:
Do not edit, merge or convert this pcapng files, because it will remove optional comment fields!
$ hcxpcapngtool --help
Do not edit, merge or convert pcapng files! This will remove optional comment fields!
Detection of bit errors does not work on cleaned dump files!
Code:
$ hcxpcapngtool test.cap
reading from test.cap...
summary capture file
file name................................: test.cap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 08.05.2018 03:28:56
timestamp maximum (GMT)..................: 08.05.2018 03:51:36
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianess (capture system)...............: little endian
packets inside...........................: 9305
frames with correct FCS..................: 1874
BEACON (total)...........................: 4055
PROBEREQUEST.............................: 326
PROBEREQUEST (directed)..................: 113
PROBERESONSE.............................: 1347
ASSOCIATIONREQUEST (total)...............: 54
ASSOCIATIONREQUEST (PSK).................: 32
REASSOCIATIONREQUEST (total).............: 15
REASSOCIATIONREQUEST (PSK)...............: 7
EAPOL messages (total)...................: 2952
EAPOL RSN messages.......................: 2954
EAPOL WPA messages.......................: 2
ESSID (total unique).....................: 1500
ESSID changes (mesured maximum)..........: 6 (warning)
EAPOLTIME gap (measured maximum usec)....: 1826255
REPLAYCOUNT gap (measured maximum).......: 8
EAPOL M1 messages........................: 2398
EAPOL M2 messages........................: 445
EAPOL M3 messages........................: 93
EAPOL M4 messages........................: 16
EAPOL pairs (total)......................: 9011
EAPOL pairs (best).......................: 27
EAPOL M12E2..............................: 24
EAPOL M32E2..............................: 2
EAPOL M34E4..............................: 1
PMKID (total)............................: 64
PMKID (useless)..........................: 2
PMKID (best).............................: 16
malformed packets (total)................: 1512
BROADCAST MAC error (malformed packets)..: 1014
IE TAG length error (malformed packets)..: 342
ESSID error (malformed packets...........: 145
EAPOL messages (malformed packets).......: 60
versus:
$ hcxpcapngtool test.cap --ignore-ie
reading from test.cap...
summary capture file
file name................................: test.cap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 08.05.2018 03:28:56
timestamp maximum (GMT)..................: 08.05.2018 03:51:36
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianess (capture system)...............: little endian
packets inside...........................: 9305
frames with correct FCS..................: 1874
BEACON (total)...........................: 4055
PROBEREQUEST.............................: 326
PROBEREQUEST (directed)..................: 113
PROBERESONSE.............................: 1347
ASSOCIATIONREQUEST (total)...............: 54
ASSOCIATIONREQUEST (PSK).................: 32
REASSOCIATIONREQUEST (total).............: 15
REASSOCIATIONREQUEST (PSK)...............: 7
EAPOL messages (total)...................: 2952
EAPOL RSN messages.......................: 2954
EAPOL WPA messages.......................: 2
ESSID (total unique).....................: 1500
ESSID changes (mesured maximum)..........: 6 (warning)
EAPOLTIME gap (measured maximum usec)....: 1826255
REPLAYCOUNT gap (measured maximum).......: 8
EAPOL M1 messages........................: 2398
EAPOL M2 messages........................: 445
EAPOL M3 messages........................: 93
EAPOL M4 messages........................: 16
EAPOL pairs (total)......................: 9051
EAPOL pairs (best).......................: 29
EAPOL M12E2..............................: 26
EAPOL M32E2..............................: 2
EAPOL M34E4..............................: 1
PMKID (total)............................: 64
PMKID (useless)..........................: 2
PMKID (best).............................: 19
malformed packets (total)................: 1512
BROADCAST MAC error (malformed packets)..: 1014
IE TAG length error (malformed packets)..: 342
ESSID error (malformed packets...........: 145
EAPOL messages (malformed packets).......: 60
Malformed packets detected!
In monitor mode the adapter does not check to see if the cyclic redundancy check (CRC)
values are correct for packets captured. The device is able to detect the Physical Layer
Convergence Procedure (PLCP) preamble and is able to synchronize to it, but if there is
a bit error in the payload. This can lead to unexpected results.
Please analyze the dump file with Wireshark.Than compare the results:
EAPOL pairs (best).......................: 27
vs
EAPOL pairs (best).......................: 29
I can't recommend to edit a hcxdumptool pcapng file, because this will remove important informations!
$ hcxdumptool --help:
Do not edit, merge or convert this pcapng files, because it will remove optional comment fields!
$ hcxpcapngtool --help
Do not edit, merge or convert pcapng files! This will remove optional comment fields!
Detection of bit errors does not work on cleaned dump files!