hcxtools - solution for capturing wlan traffic and conversion to hashcat formats

[ZerBea]

You can do this running hcxpcapngtool without options to save files:

Code:

$ hcxpcapngtool test.cap reading from test.cap... summary capture file file name................................: test.cap version (pcap/cap).......................: 2.4 (very basic format without any additional information) timestamp minimum (GMT)..................: 08.05.2018 03:28:56 timestamp maximum (GMT)..................: 08.05.2018 03:51:36 link layer header type...................: DLT_IEEE802_11_RADIO (127) endianess (capture system)...............: little endian packets inside...........................: 9305 frames with correct FCS..................: 1874 BEACON (total)...........................: 4055 PROBEREQUEST.............................: 326 PROBEREQUEST (directed)..................: 113 PROBERESONSE.............................: 1347 ASSOCIATIONREQUEST (total)...............: 54 ASSOCIATIONREQUEST (PSK).................: 32 REASSOCIATIONREQUEST (total).............: 15 REASSOCIATIONREQUEST (PSK)...............: 7 EAPOL messages (total)...................: 2952 EAPOL RSN messages.......................: 2954 EAPOL WPA messages.......................: 2 ESSID (total unique).....................: 1500 ESSID changes (mesured maximum)..........: 6 (warning) EAPOLTIME gap (measured maximum usec)....: 1826255 REPLAYCOUNT gap (measured maximum).......: 8 EAPOL M1 messages........................: 2398 EAPOL M2 messages........................: 445 EAPOL M3 messages........................: 93 EAPOL M4 messages........................: 16 EAPOL pairs (total)......................: 9011 EAPOL pairs (best).......................: 27 EAPOL M12E2..............................: 24 EAPOL M32E2..............................: 2 EAPOL M34E4..............................: 1 PMKID (total)............................: 64 PMKID (useless)..........................: 2 PMKID (best).............................: 16 malformed packets (total)................: 1512 BROADCAST MAC error (malformed packets)..: 1014 IE TAG length error (malformed packets)..: 342 ESSID error (malformed packets...........: 145 EAPOL messages (malformed packets).......: 60 versus: $ hcxpcapngtool test.cap --ignore-ie reading from test.cap... summary capture file file name................................: test.cap version (pcap/cap).......................: 2.4 (very basic format without any additional information) timestamp minimum (GMT)..................: 08.05.2018 03:28:56 timestamp maximum (GMT)..................: 08.05.2018 03:51:36 link layer header type...................: DLT_IEEE802_11_RADIO (127) endianess (capture system)...............: little endian packets inside...........................: 9305 frames with correct FCS..................: 1874 BEACON (total)...........................: 4055 PROBEREQUEST.............................: 326 PROBEREQUEST (directed)..................: 113 PROBERESONSE.............................: 1347 ASSOCIATIONREQUEST (total)...............: 54 ASSOCIATIONREQUEST (PSK).................: 32 REASSOCIATIONREQUEST (total).............: 15 REASSOCIATIONREQUEST (PSK)...............: 7 EAPOL messages (total)...................: 2952 EAPOL RSN messages.......................: 2954 EAPOL WPA messages.......................: 2 ESSID (total unique).....................: 1500 ESSID changes (mesured maximum)..........: 6 (warning) EAPOLTIME gap (measured maximum usec)....: 1826255 REPLAYCOUNT gap (measured maximum).......: 8 EAPOL M1 messages........................: 2398 EAPOL M2 messages........................: 445 EAPOL M3 messages........................: 93 EAPOL M4 messages........................: 16 EAPOL pairs (total)......................: 9051 EAPOL pairs (best).......................: 29 EAPOL M12E2..............................: 26 EAPOL M32E2..............................: 2 EAPOL M34E4..............................: 1 PMKID (total)............................: 64 PMKID (useless)..........................: 2 PMKID (best).............................: 19 malformed packets (total)................: 1512 BROADCAST MAC error (malformed packets)..: 1014 IE TAG length error (malformed packets)..: 342 ESSID error (malformed packets...........: 145 EAPOL messages (malformed packets).......: 60 Malformed packets detected! In monitor mode the adapter does not check to see if the cyclic redundancy check (CRC) values are correct for packets captured. The device is able to detect the Physical Layer Convergence Procedure (PLCP) preamble and is able to synchronize to it, but if there is a bit error in the payload. This can lead to unexpected results. Please analyze the dump file with Wireshark.

Than compare the results:
EAPOL pairs (best).......................: 27
vs
EAPOL pairs (best).......................: 29

I can't recommend to edit a hcxdumptool pcapng file, because this will remove important informations!
$ hcxdumptool --help:
Do not edit, merge or convert this pcapng files, because it will remove optional comment fields!

$ hcxpcapngtool --help
Do not edit, merge or convert pcapng files! This will remove optional comment fields!
Detection of bit errors does not work on cleaned dump files!