{"action":"closed","issue":{"url":"https://api.github.com/repos/jbenden/aircrack-ng/issues/12","repository_url":"https://api.github.com/repos/jbenden/aircrack-ng","labels_url":"https://api.github.com/repos/jbenden/aircrack-ng/issues/12/labels{/name}","comments_url":"https://api.github.com/repos/jbenden/aircrack-ng/issues/12/comments","events_url":"https://api.github.com/repos/jbenden/aircrack-ng/issues/12/events","html_url":"https://github.com/jbenden/aircrack-ng/issues/12","id":294115204,"number":12,"title":"Special handling of spanning tree packets","user":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"labels":[{"id":825822646,"url":"https://api.github.com/repos/jbenden/aircrack-ng/labels/%23general","name":"#general","color":"0000aa","default":false},{"id":825823570,"url":"https://api.github.com/repos/jbenden/aircrack-ng/labels/@minor","name":"@minor","color":"dcffff","default":false},{"id":825821855,"url":"https://api.github.com/repos/jbenden/aircrack-ng/labels/bug","name":"bug","color":"d73a4a","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/jbenden/aircrack-ng/milestones/14","html_url":"https://github.com/jbenden/aircrack-ng/milestone/14","labels_url":"https://api.github.com/repos/jbenden/aircrack-ng/milestones/14/labels","id":3085803,"number":14,"title":"0.7","description":"Apply all patches and fixes from the forum, implement fragmentation attack, and of course bug fixing.","creator":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":9,"state":"closed","created_at":"2018-02-03T14:26:52Z","updated_at":"2018-02-03T14:33:58Z","due_on":"2007-01-19T08:00:00Z","closed_at":"2018-02-03T14:26:52Z"},"comments":8,"created_at":"2018-02-03T14:33:36Z","updated_at":"2018-02-03T14:33:58Z","closed_at":"2018-02-03T14:33:58Z","author_association":"OWNER","body":"**Reported by misterx on 16 Dec 2006 12:33 UTC**\n\nMany access points (e.g. Linksys) send out spanning tree BPDU packets every second or so.  These packets are WEP encrypted and thus contribute to the IV data used for cracking.  There is only one small problem: The first two bytes of these packets (before encryption) are not 0xAA, but 0x42.\n\nCurrently, aircrack-ng sort of ignores this. Given that these STP packets are usually only a small fraction of the total number of packets with IV data, the incorrect assumption about the first two bytes only contributes a little bit of statistical noise to the analysis, but with enough packets, it doesn't make too much of a difference.  However, what this means is that there is a bit of room for improvement to make the analysis more accurate with less IV data.\n\nThe STP packets can be easily identified, because the Destination Address in the packet header will be 01:80:C2:00:00:00 (which is the All STP bridges multicast MAC address). So for these packets, we can have airodump-ng modify the IV data it saves to the .ivs file as follows:\n\nif (Destination Address of packet == 01:80:C2:00:00:00)\n   write 3 byte IV to .ivs file [  outbyte1 = (outbyte1 XOR 0x42) XOR 0xAA [[BR]([BR]]\n)]\n   outbyte2 = (outbyte2 XOR 0x42) XOR 0xAA [  write outbyte1, outbyte2 to .ivs file [[BR]([BR]]\n)]\n\nWhat we are doing here is xoring the output bytes with 0x42 to recover the keystream and then xoring that with 0xAA so that when aircrack-ng applies the FMS and KoreK attacks to the (IV, output byte) set, the assumption that the plaintext output bytes before encryption == 0xAA will be correct (even though in the original packet, this assumption would have been incorrect).\n\nThis should help remove some false positives/negatives and make the analysis more accurate.\n\nThere's also issues when chopchoping STP packets.\n\nMigrated-From: https://trac.aircrack-ng.org/ticket/12"}}
{"actor":{"display_login":"jbenden"}}