Great, thanks for posting your result. Some words about nonce error corrections (NC):
NC values have a deep impact on hashcat speed. Within hccapx and 22000 hash records the message pair field is used, to tell hashcat what to do (NC on big endian, NC on little endian, NC on both). That will drop speed. Mostly, you need NC only if you captured traffic, running a passive dumper (tshark, Wireshark, kismet, airodump-ng) to compensate a possible packet loss. Also it is important to know that NC is not possible on all types of EAPOL messages. To detect that NC is possible, we need at least 2 different ANONCEs from 2 different authentication sequences of the same ACCESS POINT.
On active attacks (M1M2ROGUE), NC can be disabled (=0). Here we have no packet loss, because a missing EAPOL message is requested immediately by the attack tool.
Also there are speed differences between mask, wordlist, wordlist +rule tasks within the same hash mode. But running wordlist +rule by hash mode 2500 should be the same as running wordlist +rule by hash mode 22000.
You shouldn't compare average speed values between
Status...........: Quit
and
Status...........: Exhausted
because that falsifies the result. In that case you can't rely on the average speed value (e.g. 1037.0 kH/s), only. It is much more precise and accurate to use Linux time function over the whole task (up to Exhausted).
example:
Status...........: Quit
versus
Status...........: Exhausted
big difference in average speed:
Speed.#1.........: 554.3 kH/s
versus
Speed.#1.........: 529.4 kH/s
NC values have a deep impact on hashcat speed. Within hccapx and 22000 hash records the message pair field is used, to tell hashcat what to do (NC on big endian, NC on little endian, NC on both). That will drop speed. Mostly, you need NC only if you captured traffic, running a passive dumper (tshark, Wireshark, kismet, airodump-ng) to compensate a possible packet loss. Also it is important to know that NC is not possible on all types of EAPOL messages. To detect that NC is possible, we need at least 2 different ANONCEs from 2 different authentication sequences of the same ACCESS POINT.
On active attacks (M1M2ROGUE), NC can be disabled (=0). Here we have no packet loss, because a missing EAPOL message is requested immediately by the attack tool.
Also there are speed differences between mask, wordlist, wordlist +rule tasks within the same hash mode. But running wordlist +rule by hash mode 2500 should be the same as running wordlist +rule by hash mode 22000.
You shouldn't compare average speed values between
Status...........: Quit
and
Status...........: Exhausted
because that falsifies the result. In that case you can't rely on the average speed value (e.g. 1037.0 kH/s), only. It is much more precise and accurate to use Linux time function over the whole task (up to Exhausted).
example:
Status...........: Quit
Code:
Session..........: hashcat
Status...........: Quit
Hash.Name........: WPA-EAPOL-PBKDF2
Hash.Target......: 8381533406003807685881523 (AP:ae:f5:0f:22:80:1c STA:98:7b:dc:f9:f9:50)
Time.Started.....: Mon Mar 23 14:38:23 2020 (2 secs)
Time.Estimated...: Mon Mar 23 14:38:43 2020 (18 secs)
Guess.Base.......: File (hashes.org-2020.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 554.3 kH/s (11.31ms) @ Accel:8 Loops:128 Thr:1024 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 1110006/11204181 (9.91%)
Rejected.........: 192502/1110006 (17.34%)
Restore.Point....: 1110006/11204181 (9.91%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#1....: 1know1can -> 28_90_80
Hardware.Mon.#1..: Temp: 62c Fan: 45% Util: 71% Core:1873MHz Mem:5005MHz Bus:16versus
Status...........: Exhausted
Code:
Session..........: hashcat
Status...........: Exhausted
Hash.Name........: WPA-EAPOL-PBKDF2
Hash.Target......: 8381533406003807685881523 (AP:ae:f5:0f:22:80:1c STA:98:7b:dc:f9:f9:50)
Time.Started.....: Mon Mar 23 14:38:34 2020 (18 secs)
Time.Estimated...: Mon Mar 23 14:38:52 2020 (0 secs)
Guess.Base.......: File (hashes.org-2020.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 529.4 kH/s (11.45ms) @ Accel:8 Loops:128 Thr:1024 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 11204181/11204181 (100.00%)
Rejected.........: 1814848/11204181 (16.20%)
Restore.Point....: 11204181/11204181 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#1....: xt3180157xt -> ~~~~GamE99
Hardware.Mon.#1..: Temp: 73c Fan: 53% Util:100% Core:1733MHz Mem:5005MHz Bus:16big difference in average speed:
Speed.#1.........: 554.3 kH/s
versus
Speed.#1.........: 529.4 kH/s