Re: WPA / WEP cracking...
While what you say is essentially true, remember there are other tools than your own comp to launch brutes. For example, the pyrit project using GPUs (http://code.google.com/p/pyrit/ and might be included in BT5??) as well as the WPACracker project (http://www.wpacracker.com/) who will run the handshake against their huge dictionary using their own cluster (and there are many other services like this). From what I gather, generating rainbow tables for a single ESSID is not recommended, as it is slower than an actual dictionary attack? Also not recommended due to the fact that you can only use it for that ESSID or something? But those last two statements of mine are conjecture and could be wrong.
You probably also want to look into coWPAtty. http://wirelessdefence.org/Contents/coWPAttyMain.htm