After converting a dumpfile.pcapng to .22000 no record

[ZerBea]

Thanks.

The NETWORKS inside the dump file are running WPA3 (SAE (SHA256)):

Code:

Tag: RSN Information
    Tag Number: RSN Information (48)
    Tag length: 24
    RSN Version: 1
    Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
    Pairwise Cipher Suite Count: 1
    Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
    Auth Key Management (AKM) Suite Count: 2
    Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK 00:0f:ac (Ieee 802.11) SAE (SHA256)
    RSN Capabilities: 0x0080

Packets 49 to 52 show a 4 way handshake - but it is a WPA3 handshake!
Please take a look at the RSN-IE of packet 50:

Code:

Tag: RSN Information
    Tag Number: RSN Information (48)
    Tag length: 38
    RSN Version: 1
    Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
    Pairwise Cipher Suite Count: 1
    Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
    Auth Key Management (AKM) Suite Count: 1
    Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) SAE (SHA256)
    RSN Capabilities: 0x00cc
    PMKID Count: 1
    PMKID List

The same applies to 55 to 59. Packet 56 RSN-I shows WPA3.
hcxpcapngtool does not convert them, because hashcat has no hash mode to recover a WPA3 PSK.

But hcxpcapngtool showed an information:

Code:

$ hcxpcapngtool -o test.22000 *.pcapng
hcxpcapngtool 6.3.4-33-g62901cb reading from dumpfile.pcapng...

summary capture file
--------------------
...
REASSOCIATIONREQUEST (SAE SHA256)........: 2
EAPOL M1 messages (KDV:0 AKM defined)....: 6 (PMK not recoverable)
EAPOL M2 messages (KDV:0 AKM defined)....: 2 (PMK not recoverable)
EAPOL M3 messages (KDV:0 AKM defined)....: 3 (PMK not recoverable)
EAPOL M4 messages (KDV:0 AKM defined)....: 2 (PMK not recoverable)
RSN PMKID (KDV:0 AKM defined)............: 6 (PMK not recoverable)
...
Information: no hashes written to hash files

session summary
---------------
processed pcapng files................: 1