In your case:
[16:26:17 - 001] 009fa9073914 -> 5c93a20b3897 [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2516]
[16:40:15 - 001] 009fa9073914 -> ccfb65942f7e [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2651]
[17:39:53 - 011] 2c56dc54e238 -> 5ccf7f48a404 [FOUND PMKID]
009fa9073914 doesn't have PMKID caching enabled - you will not get a PMKID from this AP.
Please read this:
https://hashcat.net/forum/thread-7717-po...l#pid41863
https://hashcat.net/forum/thread-7717-po...l#pid41864
The filter is only used in the transmission branch. The receiving branch remains untouched.
To understand hcxtools and hcxdumptool read this complete thread:
https://hashcat.net/forum/thread-7717.html
and that complete thread:
https://hashcat.net/forum/thread-6661.html
running without a filter list:
filter list (both filter modes) doesn't work on CLIENTs which use mac randomization
to make sure, we get all entries from the CLIENTs wpa-supplicant.conf, hcxdumptool will respond (depending on filter list and filter mode) to all requests from the CLIENT until the CLIENT give up.
Passive (hcxdumptool doesn't interact with AP and/or CLIENT):
[FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2516]
[FOUND PMKID]
Active (hcxdumptool interacts with AP and/or CLIENT):
[FOUND HANDSHAKE AP-LESS, EAPOL TIMEOUT 3981]
[FOUND PMKID CLIENT-LESS]
Added also additional informations to hcxdumptool -h:
--filterlist=<file> : mac filter list
format: 112233445566 + comment
maximum line lenght 255, maximum entries 64
important note:
only used in the transmission branch
the receiving branch remains untouched
[16:26:17 - 001] 009fa9073914 -> 5c93a20b3897 [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2516]
[16:40:15 - 001] 009fa9073914 -> ccfb65942f7e [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2651]
[17:39:53 - 011] 2c56dc54e238 -> 5ccf7f48a404 [FOUND PMKID]
009fa9073914 doesn't have PMKID caching enabled - you will not get a PMKID from this AP.
Please read this:
https://hashcat.net/forum/thread-7717-po...l#pid41863
https://hashcat.net/forum/thread-7717-po...l#pid41864
The filter is only used in the transmission branch. The receiving branch remains untouched.
To understand hcxtools and hcxdumptool read this complete thread:
https://hashcat.net/forum/thread-7717.html
and that complete thread:
https://hashcat.net/forum/thread-6661.html
running without a filter list:
- hcxdumptool captures everything it receives and will interact with all APs and CLIENTs in range.
- running with filter list and filter mode 1:
hcxdumptool captures everything it receives and will interact with all APs and CLIENTs in range,
except(!) the ones from the filter list
- running with filter list and filter mode 2:
hcxdumptool captures everything it receives and will interact only with the APs and CLIENTs in range
from the filter list
filter list (both filter modes) doesn't work on CLIENTs which use mac randomization
to make sure, we get all entries from the CLIENTs wpa-supplicant.conf, hcxdumptool will respond (depending on filter list and filter mode) to all requests from the CLIENT until the CLIENT give up.
Passive (hcxdumptool doesn't interact with AP and/or CLIENT):
[FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2516]
[FOUND PMKID]
Active (hcxdumptool interacts with AP and/or CLIENT):
[FOUND HANDSHAKE AP-LESS, EAPOL TIMEOUT 3981]
[FOUND PMKID CLIENT-LESS]
Added also additional informations to hcxdumptool -h:
--filterlist=<file> : mac filter list
format: 112233445566 + comment
maximum line lenght 255, maximum entries 64
important note:
only used in the transmission branch
the receiving branch remains untouched