Does the Alfa AWUS036NH work with Aircrack in BT5R2?

[James2k]

I recently purchased an Alfa AWUS036NH USB WiFi Adapter but keep hitting a problem with captures via airodump-ng (Aircrack).

I have a old router lying around which I use for testing, I set it to WEP encryption for quick test. In the scenario I created, I fake associated with my test access point and proceeded to capture ARP requests, this all works fine but as soon as loads of IV's are generated the data count on airodump-ng didn't go up one bit even though I could see my client mac constantly re-injecting ARP requests, I found this strange. I then noticed I got a decloak message in my capture:

CH 11 ][ Elapsed: 8 mins ][ 2012-06-16 10:32 ][ Decloak: xx:xx:xx:xx:xx:xx

The x characters are what would be BSSID of my test router.

I have never seen this message before ever and am very confused as to what it means. I'm not sure what I'm doing wrong, I can crack the WEP key of my test access point with no problem using my laptops built in Wireless Card (Intel Centrino 6230N) but with the Alfa it seems to fail with this Decloak message.

Does anyone have an ideas as to what I'm doing wrong?

I'm running Backtrack 5 R2 KDE (64-bit) USB install

[maverik35]

If module for Card (Alfa USB) is rt37, is fully supported by aircrack-ng suite....Check in terminal lsmod | grep -i rt* or -i rt43* and see if that is the module loaded by kernel...You can aldo check the dmesg (kernel buffer)...See what module was loaded.

I never use USB install...Never, ever...Use a CD or DVD live instead....You may be running into a lots of problems. It is your call my friend.

[James2k]

According to airmon-ng the module it loads is rt2800usb. I did perform an injection test with it and it said it worked, I was also able to fake associate with my test AP I have.

I have never had a problem with my USB install, my built in WiFi card in my XPS 15z works fine with the USB install. Surely CD/DVD is slightly redundant if you need persistence, unless you write capture sessions etc to a hard drive?

[Alundra]

Hey everyone!

I was doing some research on high gain wifi dongles and i found out about the Alfa AWUS036H, AWUS036NH, AWUS051NH and
AWUS036NHR devices, which seem to have a pretty good range, with stability and latency varying with each model.

Now, I need a usb wifi dongle that will let me do the following things:

Use it in Windows 7 64 bit
Have the minimum possible latency, so I can connect my PS3/other consoles via Ethernet cable from the console to my laptop, share internet with it and be able to play with minimum lag on console and PC.
Be able to get optimum signal, more stability and better latency on the Access Points that i currently have access to.
Stability.
Be able to inject packets with backtrack 5 r2 via Vmware, with aircrack,reaver etc.

Now my doubt is, which one of those 3 should I get? Or should i get some other wifi dongle?

I was thinking of getting the AWUS036NHR for getting future proof, but im afraid of the failure rates and no support for backtrack 5

My need is not so much for the over 150mpbs bandwidth, but the latency, i really need the smallest latency I can get, and maybe the N protocol, because i get alot of N access points around here, which also transmit in B/G but the link should be better with a N compatible device.

On this video comparison the AWUS036NH seems to have better ping results than the AWUS036H


But if i got AWUS036H for packet injection only, what other wifi adapter would you advise me for high gain capacity and small latency?

What do you guys think?

and btw Is the awus036nhr as bad and has high failure rates as people say?

Thanks in advance!

[James2k]

Nice thread hijack there.

[James2k]

I figured out what was causing the Decloak message to appear on the airodump-ng capture.

When running the fake association command such as:

aireplay-ng -1 6000 -o 1 -q 10 -e teddy -a 00:14:6C:7E:40:80 -h 00:09:5B:EC:EE:F2 ath0

As soon as the first keep alive packet is sent I get Decloak: xx:xx:xx:xx:xx:xx in my capture.

Running the standard association like this one:

aireplay-ng -1 0 -e teddy -a 00:14:6C:7E:40:80 -h 00:09:5B:EC:EE:F2 ath0

Doesn't cause a problem. Like I said this has never happened before with my WiFi card built into my laptop but that seems to be the cause of the problem in that respect.

Can anyone explain what the Decloak message means exactly?

[maverik35]

I figured out what was causing the Decloak message to appear on the airodump-ng capture.

When running the fake association command such as:

aireplay-ng -1 6000 -o 1 -q 10 -e teddy -a 00:14:6C:7E:40:80 -h 00:09:5B:EC:EE:F2 ath0

As soon as the first keep alive packet is sent I get Decloak: xx:xx:xx:xx:xx:xx in my capture.

Running the standard association like this one:

aireplay-ng -1 0 -e teddy -a 00:14:6C:7E:40:80 -h 00:09:5B:EC:EE:F2 ath0

Doesn't cause a problem. Like I said this has never happened before with my WiFi card built into my laptop but that seems to be the cause of the problem in that respect.

Can anyone explain what the Decloak message means exactly?

The second option, you used the correct syntax, in the first one, I do not know of any "6000" parameter as such. I would recommend to you to read fully the syntax of attacks before using them.

Here is the link: http://www.aircrack-ng.org/doku.php?id=aireplay-ng (all syntax attacks)

Read it. I do not see any parameter as "6000" in the syntax as such...The -o (packets per burst) and the -q (keep alive time) are ok thouhg...Perhaps you meant to use the -x parameter (Packets per second).

Why would you need to use the packet bursting?...I know that some routers need the keep alive parameter to avoid disconections and in some cases only.

By the way, you posted that you had an INTEL internal wifi card and the alfa AWUS036NH (Ralink chipset)...Why using ath0?.

Do you know how to use the ifconfig, iwconfig, lspci | grep -i network, lspci | grep -i ethernet?..You will see what you have and your interfaces connected...

I was looking at Dell site and the Atheros is the chipset for the Ethernet port (ath0), here is the link:

http://www.dell.com/support/drivers/us/en/19

You are using ath0 to inject?...No way my dear friend. It is not possible. Perhaps that is why you are getting the Decloack message...

Luck.

[James2k]

Sorry I better explain things a bit further.

The commands I posted I took from the official aircrack Wiki as an example of what I was using. I am not using my Ethernet Adapter for injection (lol). My WiFi card in my XPS 15z is an Intel Centrino 6230-N, which has full support and works great. The interface when I actually use the commands for my setup is mon0 I am not using ath0, the first command is valid, it is mentioned in several places on the Wiki, here's one place:

http://www.aircrack-ng.org/doku.php?...fc52d4c347b89c

I have used the Keep Alive variant so I don't become de-authed sometimes if I am doing long captures when testing.

I have used the above command with my built in WiFi card and have had 0 problems, since using the AWUS036NH I have kept getting this Decloak xx:xx:xx:xx:xx:xx in my captures. If I do the same test with my built in WiFi card everything goes fine and it works, like I said I've never seen that message before ever. This Decloak message seems to the problem as when I inject the data count doesn't go up at all.

Its confusing because it looks like the AWUS036NH is supported, but for a simple WEP test, I came across this strange behavior and problem.

Hopefully that explains things further. I basically want to find out what the Decloak message means but I can't find an answer anywhere, but I believe in terms of commands I am doing everything right, as this only happens with the Alfa card but not my built in WiFi card.

[Magnet0]

i want to ask about this matter, it makes me confused badly.
i have a laptop which is wifi supported pre installed in it.

but when im trying to use backtrack5 and install it in VBox, and tried to enter this in new terminal
airmon-ng
it only shows
Interface,chipset, and drivers with no corresponding details on it.

now it comes on my mind that maybe i need to buy wifi dongle to be able to recognize may driver.
now i want to ask your opinions and suggestions regarding this problem.
thanks

[James2k]

i want to ask about this matter, it makes me confused badly.
i have a laptop which is wifi supported pre installed in it.

but when im trying to use backtrack5 and install it in VBox, and tried to enter this in new terminal
airmon-ng
it only shows
Interface,chipset, and drivers with no corresponding details on it.

now it comes on my mind that maybe i need to buy wifi dongle to be able to recognize may driver.
now i want to ask your opinions and suggestions regarding this problem.
thanks

Not sure if this is your situation but when you install BackTrack via Virtual Machine you won't be able to use the normal hardware inside your machine like your built in WiFi card, graphics card, network card etc. In order to have a wireless card working within a virtual machine you need to purchase a USB WiFi adapter as you are able to use USB devices connected to the host machine within a virtual machine. The Alfa in this case is a great choice for this.

You might want to start a new thread for your query.