32 hours in and still nothing, Have I done something wrong here?

[Snoopy]

No worries. It can take years. 9 characters is way too much to bruteforce for -m 22000.

Thanks for the answer! How many characters would you go with?

as already mentioned, 8 is minimum, but also bruteforcing > 8 chars (with this slow algorithm) is just waste of time, see your ETA Line ~27.000 YEARS! even when assuming stochastics kick in and halving this time, this will still be 13.500 years

the more you know about your "target" the better, first the capture from this wlan router, was the bssid changed or was the preshipped style used? knowing this you could assume wheter the user also changed the preshipped key or not, if not, do some research on this specific router, how does the preshipped key looks like? does it uses specail chars or only plain lower, upper, digits?

next, ist there any security flaw already known? back then, some manufactors used the mac-adress of specific routers and a simple conversion for generating the default key, some certs or security researchers found out, made a proof of concept keygen and viola, any of these router with unchanged keys went fubar