aireplay help

[Gallo75]

Hello all,
First of all i'm new to backtrack, i've been using for like 1 week, so far i managed to dual boot installed XP and BT4 on my old sony laptop so that's an advance.

I've been playing around with both my linksys (flashed with dd-wrt) and my 2wire trying to break the wep keys, i've been doing it on both routers with no problems until i decided to hide the BSSID on the 2wire one, first 2 steps went well (airodump) but once i use aireplay i get this message:

No source MAC (-h) specified. Using the device MAC (00:1D:7E:9B:C6:42)
15:11:07  Waiting for beacon frame (BSSID: 00:24:56:A7:7F:C9) on channel 11
Please specify an ESSID (-e)

This is what i'm typing:

- aireplay-ng -1 0 -a (BSSID) wlan0...

I can see the BSSID when i use airodump but it only says "lenght 0" and i know that's mine cuz of the mac address but i've been searching on how to make it work if it's hidden with no luck.
BTW i'm using a linksys wireless USB adapter to do this with no issues (until now) i'm using the same USB adapter and BT4 to send this message everything works

anyone care to help?
thx all in advance, cheers

[cseven]

Even though the ESSID is hidden you should specify the -e <ESSID Name> in your command:
aireplay-ng -1 0 -a (BSSID) -e (ESSID) wlan0...

read:
aireplay-ng [Aircrack-ng]

Hidden SSIDs "<length: ?>"

Many aireplay-ng commands require knowing the SSID. You will sometimes see ”<length: ?>” as the SSID on the airodump-ng display. This means the SSID is hidden. The ”?” is normally the length of the SSID. For example, if the SSID was “test123” then it would show up as ”<length: 7>” where 7 is the number of characters. When the length is 0 or 1, it means the AP does not reveal the actual length and the real length could be any value.

To obtain the hidden SSID there are a few options:

Wait for a wireless client to associate with the AP. When this happens, airodump-ng will capture and display the SSID.
Deauthenticate an existing wireless client to force it to associate again. The point above will apply.
Use a tool like mdk3 to bruteforce the SSID

[Gallo75]

hey thx for the quick reply

this is what i got:

 CH 11 ][ Elapsed: 9 mins ][ 2010-12-03 16:42 ][ fixed channel wlan0: 14

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 00:24:56:A7:7F:C9  -13 100     5210       25    0  11  54 . WEP  WEP    OPN  kenneth's wifi

 BSSID              STATION            PWR   Rate    Lost  Packets  Probes

i connected to the wifi and the ESSID showed up
this is what i get when i typed it as you said

root@bt:~# aireplay-ng -1 0 -a 00:24:56:A7:7F:C9 -e kenneth's wifi wlan0
>        <---just that nothing else happens

am i missing something? thx again for the help

[sickness]

You should try using the "CODE" brackets, it's easier for someone to read the output like that.

[TheFlyingDutchMan]

hey thx for the quick reply

this is what i got:

 CH 11 ][ Elapsed: 9 mins ][ 2010-12-03 16:42 ][ fixed channel wlan0: 14

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 00:24:56:A7:7F:C9  -13 100     5210       25    0  11  54 . WEP  WEP    OPN  kenneth's wifi

 BSSID              STATION            PWR   Rate    Lost  Packets  Probes

i connected to the wifi and the ESSID showed up
this is what i get when i typed it as you said

root@bt:~# aireplay-ng -1 0 -a 00:24:56:A7:7F:C9 -e kenneth's wifi wlan0
>        <---just that nothing else happens

am i missing something? thx again for the help

Maybe you can try the following:

aireplay-ng -1 0 -a 00:24:56:A7:7F:C9 -e "kenneth's wifi" wlan0

With aireplay there can't be a "space" in the essid, otherwise it won't work. Don't know if this is your solution, but you can try.