Multiple WEP keys which can be retrieved from the Pcap file

问题

Ok, i have this Cap file that i captured with Wireshark. There are multiple WEP keys which can be retrieved from the file.

Is there a way, using Wireshark or aircrack-ng, to know exactly how many wep keys that are available in that Pcap file ?

Edit: not the Wep passwords, just the number of Wep keys available.

回答1:

Wireshark has a display/filter field named wlan.wep.key.

So: Using tshark with a display filter and wc as follows might give you the desired result (altho i haven't tried it):

tshark -R wlan.wep.key -r <filename> | wc -l

Note: I don't know if there can be more than 1 WEP key in a frame. If so then the above won't give the right count.

tshark -R wlan.wep.key -Tfields -eframe.number -r <filename> should show just the frame numbers of all the frames with WEP keys.

tshark -R wlan.wep.key -Tfields -eframe.number -ewlan.wep.key -r <filename> will print out all the keys (even if more than 1 per frame).

来源：https://stackoverflow.com/questions/6004315/multiple-wep-keys-which-can-be-retrieved-from-the-pcap-file