Only one client appear

[silan10]

I have a AP above i knew sure there is more than 3 devices active but when i filter bpf and start tool only one show

That is command i used

sudo systemctl stop Networkmanager services sudo hcxdumptool -m wlan1 sudo hcxdumptool -i wlan1 -F --rcascan=active sudo hcxdumptool --bpfc="wlan addr3 a000000000000" > filter.bpf sudo hcxdumptool -i wlan1 -w filter.pcapng --bpf=filter.bpf -F --rds=1

[silan10]

I used aircrack and got handshake quick but in hcxdumptool
I get + only in 1 3 S
R P nothing

[ZerBea]

First of all, this is not an issue, because hcxdumptool is working as expected.
I move this report to discussions, where it belongs

[silan10]

How i get pmkid ?

[ZerBea]

The AP must be configured for PMKID caching. Otherwise it doesn't transmit PMKIDs.
https://hashcat.net/forum/thread-7717.html

[ZerBea]

Some explanations about your command lines:
$ sudo hcxdumptool -m wlan1
There is absolutely no need to set monitor mode before you run hcxdumptool.
Except you'll run tshark or Wireshark alone (not in combination with hcxdumptool) on this interface.

$ sudo hcxdumptool --bpfc="wlan addr3 a000000000000" > filter.bpf
There is absolutely no need to run hcxdumptool as super user if you compile a BPF.

--bpfc="wlan addr3 a000000000000"
This prevent that hcxdumptool records undirected PROBEREQUESTs from CLIENTs.
It also prevent that a CLIENT can connect to hcxdumptool (to get an EAPOL M1M2ROGUE == AP-LESS attack).

You ran
$ sudo hcxdumptool -i wlan1 -F --rcascan=active
to get MAC AP, ESSID and operating channel of the AP.
There is no need to use -F (scan all frequencies) during your attack, because you know the operation channel now:
$ sudo hcxdumptool -i wlan1 -w filter.pcapng --bpf=filter.bpf -F --rds=1

You got a + in cloumn 3. From -h:

--rds=<digit>             : sort real time display
...
                              3 = + AP display     : got EAPOL M1M2M3 or EAPOL M1M2M3M4 (AUTHORIZATION) hashcat / JtR can work on)

To make things better:
disable really all services that take ACCESS to the interface

get information about target (MAC_AP, operating channel)
$ sudo hcxdumptool -i wlan1 -F --rcascan=active

compile BPF:
$ hcxdumptool --bpfc="wlan addr3 a000000000000 or wlan addr3 ffffffffffff" > attack.bpf

attack target in its operating channel (shown by rcascan, e.g. 1a):
$ sudo hcxdumptool -i wlan1 -w filter.pcapng --rds=1 --bpf=attack.bpf -c 1a

If you got a + in column P or in column 3 of AP-display, the attack has been successful.
If you got + in column 2 of CLIENT display, the AP-LESS attack on the CLIENT has been successful.

More information is here (because all this questions have already been answered):
#485
#488
#489

And of course here:
#361
The entire process to attack the (test) target is described.

[ZerBea]

BTW:
$ sudo systemctl stop NetworkManager.service

doesn't stop the wpa_supplicant:

$ ps -All | grep wpa
4 S     0     575       1  0  80   0 -  4096 -      ?        00:00:00 wpa_supplicant

[silan10]

Can you explain this methode based on what?
I setup my own router and tested it i cant get + in 3 P

I disconect wifi on my phone and reconnect
I forget network and enter password again
Ap it is behind me half meter
Nothing happend

[ZerBea]

Can you explain this method based on what?
It is based on my test environment. The the entire work flow is described here:
#361
in general:

 1 configure target AP with a PSK  (only done once)
 2 connect target CLIENT to AP
 3 generate WPA-PSK PMK: wlangenpmk (only done once)
 4 stop all services that take access to WiFi devices (only done once)
 5 plug the adapter (all USB devices connected to an USB2 port due to well known USB3 problems)
 6 create target BPF (only done once)
 7 attack target: $ time hcxdumptool
 8 convert the hash: $ hcxpcapngtool
 9 confirm the attack: $ hashcat (hashmode 22001)
10 remove test files

followed by each step (command line), e.g.:
generate PMK...
create target BPF
run attack
convert hash
confirm hash
remove test files

I can't explain that for your environment, because:
I don't know what Linux kernel you are running.
I don't know what distribution you are running and how this distribution is configured (running services).
I don't know what WiFi device you use (manufacturer and driver).
And I don't know if you meet all requirements as mentioned in README.md:

Requirements
Knowledge of radio technology.
Knowledge of electromagnetic-wave engineering.
Detailed knowledge of 802.11 protocol.
Detailed knowledge of key derivation functions.
Detailed knowledge of Linux.
Detailed knowledge of filter procedures. (Berkeley Packet Filter, capture filter, display filter, etc.)
Detailed knowledge of Bolean Operators.
Operating system: Linux (recommended: kernel >= 6.6, mandatory: kernel >= 5.15)
Recommendation: Arch Linux (notebooks and desktop systems), OpenWRT (small systems like Raspberry Pi, WiFi router)
WLAN device chipset must be able to run in monitor mode. MediaTek chipsets are preferred due to active monitor mode capabilities.
WLAN device driver must support monitor and full frame injection mode.

And I'm confused about some of your comments:
I get + only in 1 3 S
#492 (comment)

I setup my own router and tested it i cant get + in 3 P
#492 (comment)

[ZerBea]

The most common mistakes:
Services that take access to the device are not stopped.
BPF is not coded correctly.
Wrong operating channel.
Distribution is running an outdated kernel with outdated drivers (actual Linux kernel versions: https://www.kernel.org/).
Running a third party driver which is not part of the official Linux stock kernel.

[silan10]

I am using kali linux 2021

[ZerBea]

Kali Linux 2021 is nearly 5 years old and far far away from the recommended requirements. Nearly all drivers are outdated.
It came up with kernel 5.14.0 (Kali 2021.4) or kernel 5.10.0 (Kali 2021.3, Kali 2021.2, Kali 2021.41):
https://www.kali.org/releases/
Kernel 5.14 is EOL since a long time: November 2021
https://en.wikipedia.org/wiki/Linux_kernel_version_history
Kernel 5.10 is a longterm kernel and still maintained, but far below the recommendation (>= 5.15)

If you take a look at the closed issue reports (hcxtools, hcxdumptool) you'll see that all problems are related to this distribution.
If you take a look at hashcat forum, you'll see that the robot replace Kali by "The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali)"
https://hashcat.net/forum/thread-10879.html

We can go through the steps (rcascan to get MAC_AP and operating channel), compile BPF and finally run the attack, but I doubt it works running such an outdated and "not well configured by default" distribution.

Please note that Kali is neither easy to use nor easy to configure:
#418

And you should know that Kali replace several Linux stock drivers by third party drivers (mostly from aircrack-ng)
Additional the entire KALI trouble shooting references to aircrack-ng:
https://www.kali.org/docs/troubleshooting/troubleshooting-wireless-driver-issues/
That will not work on hcxtools/hcxdumptool/hcxlabtool

[ZerBea]

This is my actual test environment:

target AP: FRITZ!Box, ESSID: AP_7272, operating channel 8a, PSK: 12345678, running in transition mode WPA2/WPA3, PMKID caching is not configured
target CLIENT1: Android Phone
target CLIENT2: Linux notebook

kernel: 6.6.latest-lts or 6.12.latest (to test drivers which are not back ported to 6.6)
distribution OpenWRT (latest git) and Arch Linux
attack interface: TP-Link TL-WN822N, driver rtl8xxxu

Both, distributions are manual configured (OpenWRT is compiled via tool chain) and I exactly know what services or tools are running in background.

If you try to run hcxdumptool/hcxlabtool or hcxtools as you know it from aircrack-ng, all attacks will fail.
You have to learn from scratch as mentioned in README.md section "Requirements".

[ZerBea]

Here is a detailed how to. It shows the entire work flow, the environment, all command line options and the expected results.
#493
If you (strict) follow this tutorial, everything should be fine.
If not, there is something wrong with your environment (this very often happens if you run Kali Linux).

[silan10]

Thank you Mister