Cannot capture handshake from deauth of windows 7 machine

[LMNOParis]

post 1:

I have two laptops connected to my AP that I'm trying to capture handshakes from. One running Windows 7, the other running windows xp. Using a third laptop I'm running BT4. When I deauth the xp machine, I immediately get the handshake. I cannot get a handshake with the windows 7 machine. When I look at the cap in wireshark, it shows that I'm not getting the 2 client side parts of the handshake, but I am getting the AP's 2 parts. I spent a few hours searching this forum and remote-exploit forums to no avail. I have also tried to run airmon-ng with the channel specified, no good. Any thoughts?

post 2:

The fourth hour of searching may have yielded a solution. I found some info on how aircrack needs a patch to recognize a client's mac if the first octet isn't 00. My target windows 7 machine's mac has the first octet of 90. I'm going to try to update aircrack-ng and see what happens. In the meantime, has anyone else resolved this problem in this manner?

I updated aircrack, still no go. I spoofed the mac of the windows 7 machine in BT, and when I deauth that device, I get an immediate handshake. I'm thinking the only possibility is that the windows 7 machine is the issue. I can't find anything on issues with deauthing a windows 7 or vista machine. Any input would be appreciated.

post 3:

Anything? Anyone? If no one has a solution, has anyone at least run into this?

[kidFromBigD]

To me, it could be a driver issue in Vista. My google searching returned a couple things, related to drivers and whatnot...

hxxp://www.mydigitallife.info/2007/09/15/intel-pro-wireless-3945abg-wifi-radio-adapter-shut-off-randomly/comment-page-1/

hxxp://www.chicagotech.net/netforums/viewtopic.php?t=507

Best of luck. Try it out and report back here.

[Barry]

Just tired it with my hp. Works as advertised. Hp is running Win7 Ultimate 32bit. Deauthing machine had 2 atheros based cards in it. What wireless adapter starts with 90??

[LMNOParis]

To me, it could be a driver issue in Vista. My google searching returned a couple things, related to drivers and whatnot...

hxxp://www.mydigitallife.info/2007/09/15/intel-pro-wireless-3945abg-wifi-radio-adapter-shut-off-randomly/comment-page-1/

hxxp://www.chicagotech.net/netforums/viewtopic.php?t=507

Best of luck. Try it out and report back here.

I've only really started prodding at the win 7 machine, but the symptons in the first link look like it might be it. However, even on a fresh connect or startup with the win 7 machine there's still no handshake. I didn't think to look for anything along these lines since there's no issue on the win 7 machine until I deauth it, so thanks for the ideas.

Just tired it with my hp. Works as advertised. Hp is running Win7 Ultimate 32bit. Deauthing machine had 2 atheros based cards in it. What wireless adapter starts with 90??

Thanks for the responses, at least I know now that Windows 7 machines can be deauth-ed.


Edit:
The windows 7 machine has an Atheros AR9285. This is driving me batty.