Plugins 2500/2501 and 16800/16801 are deprecated

[ZerBea]

The last field is the message pair field.
It contain detailed information about the endianess of the router and it inform hashcat how to handle the hash
(eg. NC not necessary, NC necessary, NC only on BE necessary, NC on LE necessary)

Code:

bitmask of message pair field:
2,1,0:
000 = M1+M2, EAPOL from M2 (challenge)
001 = M1+M4, EAPOL from M4 if not zeroed (authorized)
010 = M2+M3, EAPOL from M2 (authorized)
011 = M2+M3, EAPOL from M3 (authorized) - unused
100 = M3+M4, EAPOL from M3 (authorized) - unused
101 = M3+M4, EAPOL from M4 if not zeroed (authorized)
3: reserved
4: ap-less attack (set to 1) - no nonce-error-corrections necessary
5: LE router detected (set to 1) - nonce-error-corrections only for LE necessary
6: BE router detected (set to 1) - nonce-error-corrections only for BE necessary
7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

In your case:

Code:

WPA...0000fac028000*00
00000001
M1+M2, EAPOL from M2 (challenge)

WPA...4000fac020000*02
02 = 00000010
M2+M3, EAPOL from M2 (authorized)

WPA...0000fac020c00*a2
a2 = 10100010
M2+M3, EAPOL from M2 (authorized)
LE router detected (set to 1) - nonce-error-corrections only for LE necessary
not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

WPA...0000fac020c00*a0
a0 = 10100000
M1+M2, EAPOL from M2 (challenge),
LE router detected (set to 1) - nonce-error-corrections only for LE necessary
not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

WPA...0100000020000*c2
c2 = 11000010
M2+M3, EAPOL from M2 (authorized)
BE router detected (set to 1) - nonce-error-corrections only for BE necessary
not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

Here is a hex to binary converter:
https://www.binaryhexconverter.com/hex-t...-converter

Please notice the difference between: valid , invalid, challenge and authorized!

invalid = it is impossible to recover the PSK from this message pair, because the EAPOL messages don't match,
even though if you run hashcat with the correct PSK, it will exhausted
Mostly you will get invalid message pairs if you run passive dumpers in combination with stupid deauthentication tools.
They will not detect a packet loss or if the AP renew the authentication sequence.

challenge = the CLIENT may not belong to the target network and the PSK is recoverable
this message pair is valid!

authorized = the CLIENT belong to the target network and the PSK is recoverable
this message pair is valid!