HCXDUMPTOOL 6.3.1 Out of Sequence Timestamps

[kn4thx]

Good Morning. I am running hcxdumptool on Debian Unstable latest, with hcxdumptool 6.3.1. I run the following command:`

sudo hcxdumptool -i wlx00c0ca96c9de -w dumpfile.pcapng --beacontx=10

It shows the normal SSID information as it scans the surrounding area for APs, but when exiting and running the

hcxpcapngtool -o hash.hc22000 -E essidlist dumpfile.pcapng

command, I get the following errors:

`frequency statistics from radiotap header (frequency: received packets)

not available due to missing radiotap header
Warning: out of sequence timestamps!
This dump file contains frames with out of sequence timestamps.
That is a bug of the capturing tool.`

It says it processed the the file but I am concerned processing is a waste with out of sync data.

I run this on a Alfa AWUS036NHA.

Thank you for any tips or direction.

[ZerBea]

Please attach the pcapng file (zip compressed), because I can't reproduce it on latest git head:

$ sudo hcxdumptool -i wlp5s0f3u2 -w dumpfile.pcapng
$ hcxpcapngtool -o test.22000 -E essid dumpfile.pcapng
hcxpcapngtool 6.3.2-32-gde1d781 reading from dumpfile.pcapng...

summary capture file
--------------------
file name................................: dumpfile.pcapng
version (pcapng).........................: 1.0
operating system.........................: Linux 6.6.7-arch1-1
application..............................: hcxdumptool 6.3.2-140-g80de34d
interface name...........................: wlp5s0f3u2
interface vendor.........................: 784476
openSSL version..........................: 1.1
weak candidate...........................: 12345678
MAC ACCESS POINT.........................: f03f03842ccf (incremented on every new client)
MAC CLIENT...............................: a4a6a9325af2
REPLAYCOUNT..............................: 63904
ANONCE...................................: f70750b50451b749d1064524ee5c76f5b2a8d90db36b7dbdd420fedb1a38acfd
SNONCE...................................: bd3b5d0ad50e9fd21f503a41d64bf4ed7c825edd5e6bb5cec499c36d3890ad60
timestamp minimum (GMT)..................: 28.12.2023 08:14:29
timestamp maximum (GMT)..................: 28.12.2023 08:14:32
duration of the dump tool (seconds)......: 3
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianness (capture system)..............: little endian
packets inside...........................: 220
packets received on 2.4 GHz..............: 220
ESSID (total unique).....................: 15
BEACON (total)...........................: 15
BEACON on 2.4 GHz channel (from IE_TAG)..: 6 
BEACON (SSID zeroed).....................: 1
PROBEREQUEST (undirected)................: 5
PROBERESPONSE (total)....................: 7
AUTHENTICATION (total)...................: 8
AUTHENTICATION (OPEN SYSTEM).............: 8
ASSOCIATIONREQUEST (total)...............: 1
ASSOCIATIONREQUEST (PSK).................: 1
EAPOL messages (total)...................: 184
EAPOL RSN messages.......................: 184
EAPOLTIME gap (measured maximum msec)....: 12
EAPOL ANONCE error corrections (NC)......: not detected
EAPOL M1 messages (total)................: 181
EAPOL M2 messages (total)................: 1
EAPOL M3 messages (total)................: 2
EAPOL pairs (total)......................: 2
EAPOL pairs (best).......................: 1
EAPOL pairs written to 22000 hash file...: 1 (RC checked)
EAPOL M32E2 (authorized).................: 1
RSN PMKID (useless)......................: 1
RSN PMKID (total)........................: 3
RSN PMKID (best).........................: 1
RSN PMKID ROGUE..........................: 1
RSN PMKID written to 22000 hash file.....: 1

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
 2437: 220	


session summary
---------------
processed pcapng files................: 1

Please note:
Version 6.3.1 is outdated. Please update to hcxdumptool/hcxtools 6.3.2 or latest git head.

[kn4thx]

dumpfile.zip

Thank you for the reply. I have attached the dumpfile.pcapng. I pulled the latest from the Debian repository as it was newer than what my recently replaced laptop had, but I will update accordingly and try again.

[ZerBea]

I've checked your dump file and it is looking as expected.$ hcxpcapngtool dumpfile.pcapng

hcxpcapngtool 6.3.2-32-gde1d781 reading from dumpfile.pcapng...

summary capture file
--------------------
file name................................: dumpfile.pcapng
version (pcapng).........................: 1.0
operating system.........................: Linux 6.6.8-amd64
application..............................: hcxdumptool 6.3.1
interface name...........................: wlx00c0ca96c9de
interface vendor.........................: 00c0ca
openSSL version..........................: 1.1
weak candidate...........................: 12345678
MAC ACCESS POINT.........................: 000da7e0c61c (incremented on every new client)
MAC CLIENT...............................: dc7014424d20
REPLAYCOUNT..............................: 65360
ANONCE...................................: 6688b1ae16a5565678f28b9dd638d5582392046d0e7ee6443d995f216ef96900
SNONCE...................................: 925524984d645460e7b9a7573844903c60d4c01a9264d5deb7c9b6b5d844d10c
timestamp minimum (GMT)..................: 28.12.2023 14:27:02
timestamp maximum (GMT)..................: 28.12.2023 14:29:26
duration of the dump tool (minutes)......: 2
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianness (capture system)..............: little endian
packets inside...........................: 805
frames with correct FCS..................: 805
packets received on 2.4 GHz..............: 805
ESSID (total unique).....................: 42
BEACON (total)...........................: 61
BEACON on 2.4 GHz channel (from IE_TAG)..: 1 6 11 
BEACON (SSID wildcard/unset).............: 18
BEACON (SSID zeroed).....................: 1
PROBEREQUEST (undirected)................: 10
PROBERESPONSE (total)....................: 31
AUTHENTICATION (total)...................: 25
AUTHENTICATION (OPEN SYSTEM).............: 25
ASSOCIATIONREQUEST (total)...............: 1
ASSOCIATIONREQUEST (PSK).................: 1
REASSOCIATIONREQUEST (total).............: 1
REASSOCIATIONREQUEST (PSK)...............: 1
EAPOL messages (total)...................: 676
EAPOL RSN messages.......................: 676
EAPOLTIME gap (measured maximum msec)....: 5932
EAPOL ANONCE error corrections (NC)......: not detected
REPLAYCOUNT gap (measured maximum).......: 2
EAPOL M1 messages (total)................: 671
EAPOL M2 messages (total)................: 1
EAPOL M3 messages (total)................: 3
EAPOL M4 messages (total)................: 1
EAPOL M4 messages (zeroed NONCE).........: 1
EAPOL pairs (total)......................: 1
EAPOL pairs (best).......................: 1
EAPOL M32E2 (authorized).................: 1

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
 2412: 200	 2437: 554	 2462: 51	

Information: no hashes written to hash files


session summary
---------------
processed pcapng files................: 1

[ZerBea]

BTW:
Even with Atheros AR9271, hcxdumptool v6.3.1 and hcxpcapngtool v6.3.1 I can't reproduce it:

$ lsusb
ID 0cf3:9271 Qualcomm Atheros Communications AR9271 802.11n

[hcxdumptool-6.3.1]$ sudo ./hcxdumptool -i wlp5s0f4u2 -w dumpfile.pcapng -c 11a

hcxtools-6.3.1]$ ./hcxpcapngtool -o test.22000 -E essid dumpfile.pcapng
hcxpcapngtool 6.3.1 reading from dumpfile.pcapng...

summary capture file
--------------------
file name................................: dumpfile.pcapng
version (pcapng).........................: 1.0
operating system.........................: Linux 6.6.7-arch1-1
application..............................: hcxdumptool 6.3.1
interface name...........................: wlp5s0f4u2
interface vendor.........................: f81a67
openSSL version..........................: 1.1
weak candidate...........................: 12345678
MAC ACCESS POINT.........................: 00259dcecd92 (incremented on every new client)
MAC CLIENT...............................: b0ece1b39aa8
REPLAYCOUNT..............................: 63531
ANONCE...................................: 3aecbacd34d2e0d7afdeca5f0bdce5a3b332738299497f79a8c18d4c1dafd625
SNONCE...................................: 069163941a22a97e071335d8fc962e2110ed00a7d57b22ae58f3a0992904d20b
timestamp minimum (GMT)..................: 28.12.2023 09:03:28
timestamp maximum (GMT)..................: 28.12.2023 09:03:51
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianness (capture system)..............: little endian
packets inside...........................: 288
frames with correct FCS..................: 281
packets received on 2.4 GHz..............: 281
ESSID (total unique).....................: 7
BEACON (total)...........................: 7
BEACON on 2.4 GHz channel (from IE_TAG)..: 11 
ACTION (total)...........................: 3
ACTION (containing ESSID)................: 3
PROBEREQUEST (undirected)................: 1
PROBERESPONSE (total)....................: 5
AUTHENTICATION (total)...................: 11
AUTHENTICATION (OPEN SYSTEM).............: 11
ASSOCIATIONREQUEST (total)...............: 5
ASSOCIATIONREQUEST (PSK).................: 5
EAPOL messages (total)...................: 255
EAPOL RSN messages.......................: 255
EAPOLTIME gap (measured maximum msec)....: 2555
EAPOL ANONCE error corrections (NC)......: working
REPLAYCOUNT gap (suggested NC)...........: 3
EAPOL M1 messages (total)................: 190
EAPOL M2 messages (total)................: 13
EAPOL M3 messages (total)................: 45
EAPOL M4 messages (total)................: 7
EAPOL M4 messages (zeroed NONCE).........: 7
EAPOL pairs (total)......................: 21
EAPOL (from zeroed PMK)..................: 1 (not converted by default options - use --all if needed)
EAPOL pairs (best).......................: 4
EAPOL ROGUE pairs........................: 4
EAPOL pairs written to 22000 hash file...: 4 (RC checked)
EAPOL M12E2 (challenge)..................: 4

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
 2462: 281	


session summary
---------------
processed pcapng files................: 1

[kn4thx]

I cloned the git for hcxtools and hcxdumptool, ensured I had the proper dependencies and the errors went away. I think I had an issue on my end with repository/dependencies. I thought I had it all cleaned up prior, but I assume not now. I thank you for your time and apologize if I wasted any time.

[kn4thx]

Issue salved based on git clone and proper update/upgrade.

[ZerBea]

Glad to hear that.