the first ARP (never shows up)

[-=Xploitz=-]

edit: also i think the fake auth/ass doesn't go through when there's a filter

Your right. Usually it doesn't. Thats why you'll get that error saying "Got a disassociation packet" because the AP is trying to Kick you off.

[-=Xploitz=-]

Also, have you looked at your captures with tcpdump??

Another way to identify a failed fake authentication is to run tcpdump and look at the packets. Start another session while you are injecting and…
Run:

tcpdump -n -e -s0 -vvv -i ath0

Here is a typical tcpdump error message you are looking for:

  11:04:34.360700 314us BSSID:00:14:6c:7e:40:80 DA:00:0f:b5:46:11:19 SA:00:14:6c:7e:40:80 DeAuthentication: Class 3 frame received from nonassociated station

Notice that the access point (00:14:6c:7e:40:80) is telling the source (00:0f:b5:46:11:19) you are not associated. Meaning, the AP will not process or accept the injected packets.
If you want to select only the DeAuth packets with tcpdump then you can use: “tcpdump -n -e -s0 -vvv -i ath0 | grep DeAuth”. You may need to tweak the phrase “DeAuth” to pick out the exact packets you want.


Also use wireshark to take a look at whats going on.>>>>>


Examples of successful authentications

When toubleshooting failed fake authentications, it can be helpful to do a packet capture and compare it to successful ones. As well, simply reviewing this packet captures with WireShark can be very educational.
Here are packet captures of the two types of authentication - open and shared key:

• wep.open.system.authentication.cap
• wep.shared.key.authentication.cap

[trevelyn]

cool cool, I will mess with it more when i get home tonight, i have to work the next 9 hours or so :,-( I will see what I can come up with this weekend, thanks for the chat Xploitz! <3

[773451]

That's another great tip!

[-=Xploitz=-]

That's another great tip!

They can all be found here>>>>

http://aircrack-ng.org/doku.php?id=fake_authentication

And here>>>

http://aircrack-ng.org