John the ripper questions

[stevewolf]

When I type the following command while john is running I get the following.

# john -status=john
guesses: 0 time: 8:20:31:52 0%00% (3) c/s: 4068

I don't know how to interpret this but it looks like nothing is happening.
However,
When I press the space bar on the terminal window it does give me the current PW it's tryng.

If I cat the john.pot file it shows me some passwords.

However when I type the following I get the following,

john --show john
4 password hashes cracked, 0 left

The john program continues to work, as I mentioned when I press the space bar it shows me the current try.
I also know that that the shadow file has more passwords. I can see names in the list with encrypted pw's in it.

I have been running this for about 2 months. Can anyone help me to understand the results of my various commands.

Thanks.

[rastamouse]

What was the original john command you used? Are you using a wordlist, or did you specify your own parameters? My point is, you may have asked john to use a large address space to crack your hashes.

For example, a 6 character address space of one type (e.g. lowercase) contains 3.21x10^8 combinations. If you take another 6 character address space, but of two types (e.g. lower and uppercase) the combinations increase to 2.02x10^10. Going all the way up to a 6 character address space, with 4 types (uppercase, lowercase, numbers and special characters), the combinations are 7.43x10^11.

The number of combinations may not seem all that different, but the cracking time increase by several factors each time. If you are using a larger address space (i.e. more than 6 characters), it is possible you have set your computer up for millions of years worth of work! So it may not be so surprising that you still appear to be at 0%...