After converting a dumpfile.pcapng to .22000 no record

[ZerBea]

Thanks.

The NETWORKS inside the dump file are running WPA3 (SAE (SHA256)):

Code:

Tag: RSN Information Tag Number: RSN Information (48) Tag length: 24 RSN Version: 1 Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM) Pairwise Cipher Suite Count: 1 Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM) Auth Key Management (AKM) Suite Count: 2 Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK 00:0f:ac (Ieee 802.11) SAE (SHA256) RSN Capabilities: 0x0080

Packets 49 to 52 show a 4 way handshake - but it is a WPA3 handshake!
Please take a look at the RSN-IE of packet 50:

Code:

Tag: RSN Information Tag Number: RSN Information (48) Tag length: 38 RSN Version: 1 Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM) Pairwise Cipher Suite Count: 1 Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM) Auth Key Management (AKM) Suite Count: 1 Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) SAE (SHA256) RSN Capabilities: 0x00cc PMKID Count: 1 PMKID List

The same applies to 55 to 59. Packet 56 RSN-I shows WPA3.
hcxpcapngtool does not convert them, because hashcat has no hash mode to recover a WPA3 PSK.

But hcxpcapngtool showed an information:

Code:

$ hcxpcapngtool -o test.22000 *.pcapng hcxpcapngtool 6.3.4-33-g62901cb reading from dumpfile.pcapng... summary capture file -------------------- ... REASSOCIATIONREQUEST (SAE SHA256)........: 2 EAPOL M1 messages (KDV:0 AKM defined)....: 6 (PMK not recoverable) EAPOL M2 messages (KDV:0 AKM defined)....: 2 (PMK not recoverable) EAPOL M3 messages (KDV:0 AKM defined)....: 3 (PMK not recoverable) EAPOL M4 messages (KDV:0 AKM defined)....: 2 (PMK not recoverable) RSN PMKID (KDV:0 AKM defined)............: 6 (PMK not recoverable) ... Information: no hashes written to hash files session summary --------------- processed pcapng files................: 1