Trying to get Alfa AWUS036H to work. No association taking place. (Detailed post!)

[justajohn]

So the commands pretty much speak for themselves here. I am already familiar with the tools and concepts used.

Is there a problem with this card (Alfa AWUS036H), or my method of attack?

root@root:~# lsusb | grep RTL
Bus 002 Device 002: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter
root@root:~# pkill dhclient
root@root:~# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          <<SNIP>>

wlan0     Link encap:Ethernet  HWaddr 00:c0:FF:FF:FF:FF  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan1     Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          <<SNIP>>

root@root:~# airmon-ng start wlan0


Interface	Chipset		Driver

wlan0		Realtek RTL8187L	rtl8187 - [phy0]
				(monitor mode enabled on mon0)
wlan1		Broadcom	b43 - [phy1]



root@root:~# airodump-ng mon0 -w ~/doit --channel 14 --ivs

 CH 14 ][ Elapsed: 1 min ][ 2011-05-16 20:37                                         
                                                                                                     
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID                  
                                                                                                     
 68:7F:74:EE:EE:EE   -6  96     1069       30    0  14  11   WEP  WEP         HACKME            
                                                                                                     
 BSSID              STATION            PWR   Rate    Lost  Packets  Probes                           
                                                                                                     
 68:7F:74:EE:EE:EE  00:c0:FF:FF:FF:FF    0    0 - 1      0       16       



root@root:~# aireplay-ng -1 0 -e HACKME -a 68:7F:74:EE:EE:EE -h 00:c0:FF:FF:FF:FF mon0
20:36:48  Waiting for beacon frame (BSSID: 68:7F:74:EE:EE:EE) on channel 14

20:36:48  Sending Authentication Request (Open System)

<< REPEATS FOR 10 TIMES>>
<< CHECK WLAN LIGHT ON ACCESS POINT AND NOTICE NO ACTIVITY AT ALL >> 

20:37:18  Sending Authentication Request (Open System)
Attack was unsuccessful. Possible reasons:

    * Perhaps MAC address filtering is enabled.
    * Check that the BSSID (-a option) is correct.
    * Try to change the number of packets (-o option).
    * The driver/card doesn't support injection.
    * This attack sometimes fails against some APs.
    * The card is not on the same channel as the AP.
    * You're too far from the AP. Get closer, or lower
      the transmit rate.

root@root:~# iwconfig wlan0
wlan0     IEEE 802.11bg  ESSID:off/any  
          Mode:Managed  Access Point: Not-Associated   Tx-Power=20 dBm   
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:off

[xmajectic]

Hey can you capture your own injected packets? with this driver and card? Im having problems, maybe its the same one.

[TimmyMigee]

Having the same issue.
Anyone solved this yet?

[iliyapolak]

You are too close to the AP (beacon has power measure of -6).

[Guillotine]

Try

 rfkill unblock all

Found on Google that it helped people with problems with the awus036h

[cr1p70]

Your either to close as polak said -6pwr or you are to far, + i didn't see any auth associated
1:rerun your commands make sure there right
2:move closer to AP see what happens or farther away from AP see what happens.


maybe this might be of some help.
in my XP your to far and cant associate with AP.

I have no idea why this is showing up unless your AP is turned off << REPEATS FOR 10 TIMES>>
<< CHECK WLAN LIGHT ON ACCESS POINT AND NOTICE NO ACTIVITY AT ALL

[iliyapolak]

It can not be too far because preamble has the energy that dropped only by -6 from the dc level.

[Dudeman02379]

Are you by chance running this in a virtual machine? Take a look at this link and see if it helps at all
http://www.backtrack-linux.org/wiki/...l8187_vs_r8187

[Chips]

I don't know why, but i get better injection result using ieee80211 driver than mac80211 driver.
realtek 8187 (alfa chipset) is supported by both driver (mac & ieee) and by default my backtrack 5 use mac80211 (the worst one).

To test quickly: "rmmod rtl8187 then followed by "modprobe r8187" (notice there is no "tl" which means ieee80211 driver )
Then if i do a aireplay test on wlan interface: "aireplay-ng --test wlan0" i still get injection working but this time the probe request give me better result. airbase give better result too.

Am i the only one with this kind of behavior ?