I'm in the beginning stages of a pen-test on a clients wireless network, and ran into a bit of an issue today I've never seen before. The client is running a WEP network, with no obvious special authentication or MAC filtering present, as I was able to authenticate and associate right away. There were no clients showing activity, so I proceeded to perform a clientless 0841 attack using aireplay-ng. I was capturing IV's just fine, and got to about 150k after about 30 mins, but aircrack was still unable to find the key. I've never run into this before, as all my WEP cracks have found the key after no more then 20 mins, even on WEP40. Any ideas what might be causing this need for so many IV's? I was no more then 30 yards away from the main building, and was receiving a decent strength signal.