Last Modified: 17 Aug 02- AirSnort Installation*NEW* AirSnort ONLY works with cards that pass their monitor modepackets up via the PF_PACKET interface (and thus can be read by libpcap)This includes Prism2 cards running wlan-ng 0.1.14, Orinoco cards withthe orinoco-0.11b-packet patch installed, and Cisco cards.Assuming you have one of these, and a linux installation, you must havethe following available to build AirSnort:   * gtk-1.2   * libpcap 0.7.1 or later. You should patch the stock 0.7.1 to      understand the DLT_PRISM_HEADER datalink type OR get one of      the "current builds" which incorporate the patch.   * For Orinoco cards, pcmcia-cs-3.1.34 or kernel orinoco_cs     drivers v0.11b (so that you can patch it).  The patch is     available at http://airsnort.shmoo.com/orinocoinfo.html   * For Prism2 cards, pcmcia-cs-3.1.33 and wlan-ng-0.1.14   * In order to build pcmcia-cs or wlan-ng, you will need the      kernel sourcesSee the ChangeLog for the latest changes in AirSnort.All of these are linked from our website (http://airsnort.shmoo.com)To start, you must configure the kernel source code. This will linkthe include directories in the the source tree to the system widedirectory, /usr/include. The kernel source code need not be compiledor installed, but it must be the same version as the one running. Thekernel version can be determined with the command 'uname -a.' Inaddition, the running kernel needs to support loadable modules, PCMCIA,and PF_PACKET. If the running kernel does not support these, you willneed to compile and install the source code.The source code for PCMCIA must be installed, and it must be the sameas the version you are running. To determine the version of PCMCIA CSyou are running, consult the output of the command 'cardmgr -V.' If youhave the appropriate version, you need not compile and install thesource code, but you must complete the configuration process. All ofthe defaults are okay.  If you plan to use an Orinoco card, you mustpatch the pcmcia-cs sources with an appropriate Orinoco monitor modepatch from the link mentioned above.The linux-wlan-ng is the kernel module to drive prism2 based wlan cards.If you are using a prism2 based card, you must make and install the linux-wlan-ng driver. You must [re]start the cardmgr, and you can theninsert your wlan card. If anything failed, consult the linux-wlan-ngdocumentation.Install libpcap. Get the tarball from www.tcpdump.org, build and install the pcap library.  IMPORTANT NOTE: make sure that you do nothave an old version of libpcap installed that gets located instead.This may be particularly true for RedHat users that had pcap installedvia rpm.  Make sure you uninstall the old version of pcap, or things won't work.Assuming everything went well, AirSnort can now be built. This makesthe executables 'airsnort', 'gencases', and 'decrypt. If everything went well, the section "Running AirSnort" is right for you. If anythingfailed, (predictably,) consult the appropriate package's documentation.- Running AirSnortThe first thing to be done to crack 802.11b is to get unmodifiedencrypted packets. This can be done by putting the card in a modewhich gathers all packets indiscriminately. This mode is known asmonitor mode, and it is entered automatically by selecting the'Start' button.  Choose between "scan" mode and fixed "channel" modeto scan all 11 802.11b channels or a specific channel respectively. With a capture in progress, packets are collected and saved in variousdata structures to facilitate cracking.  Packets are not saved to a file unless you choose to do so (via the File/Save menu).  You can also load the data structures from a previous capture session that didnot result in a successful crack, in order to resume packet collection.In this version of Airsnort, cracking is attempted in parallel withpacket capture.  In this implementation, the cracker attempts to crackthe captured packets for both a 40 bit and 128 bit key each time itis instructed to do so by the capture thread.  This happens each time10 interesting packets are captured.  The breadth of the search usedby the cracker can be controlled via the Settings/Preferences menuoption and defaults to 3 for 40 bit cracks and 2 for 128 bit cracks.The number of interesting packets needed to perform a successful crackdepends on two things; luck and key length. Assuming that luck is onyour side, the key length is the only important factor. For a keylength of 128 bits, this translates to about 1500 packets. For otherkey lengths, assume 115 packets per byte of the key.For a discussion of the algorithm, and how it affects runtime,and statistics, see the section "AirSnort Theory."In any case, if the crack thread believes it has a correct password,it checks the checksum of a random packet. If this is successful, thecorrect password printed in ASCII and Hex, and the successful crack isindicated by an 'X' in the leftmost column of the display. A successful crack causes packet collection for the associated SSID to cease. - Capture DetailsCapture uses either the pcap library to receive monitor mode packets.The packets go through two filters. First, non-encrypted packets arefiltered out. Then, if they are encrypted, useless packets arediscarded. All non-data packets are discarded with the exception of802.11b Beacon and probe response packets which are examined in orderto obtain access point SSID data.To distinguish encrypted and non-encrypted packets, capture examinesthe first two bytes of the output. Since unencrypted packets have a firstpair value of 0xAAAA, all of these packets get dropped. These bytescomes from the Snap header.Useful packets are those with the following property of their IV; thefirst byte is a number three greater than one of the offsets of thebytes of the key. For 128 bit encryption, this means a number from3-16. The second byte must be 255 and the third byte can have anyvalue. This means that for every byte of the key, there are 256 weakIVs.  As of version 0.2.0, two additional classes of IVs are recognized by airsnort.  See the source code for details.When every weak IV has been gathered (13 key bytes * 256 = 3315packets), there is no point to continuing the capture process. Inreality, it takes somewhat fewer packets than this. As of version0.2.0, there are on the order of 9400 resolving IVs recognized byairsnort.- Cracking DetailsWhen executing the cracking operation, crack operates with a partialkey search from the given data. Since it is a probabalistic attack, The best guess may not be the right one, so, with limited captured data and enough CPU power, you can perform more exaustive searches. By setting the breadth parameter, you can specify to search "worse" guesses. It is not suggested that you specify a breadth of more than three or four.See the paper linked on our website for a reference to the paperdescribing the attack.