Ever located an old capture file and you weren’t sure what was in it or needed to grab some quick statistics about another capture file? What about needed to run statistics on multiple capture files and present them via a database or a spreadsheet? Well if you have ever run into any of these scenarios then capinfos is worth a look. The capinfos command is available via the Backtrack CLI and provides statistic information about cap files. This is one of the gems located on Backtrack that nobody ever hears about.
I recently had a customer upload a WPA capture to our tools.question-defense.com server which failed immediately. This can happen from time to time and is for a variety of reasons Sometimes if captures does not contain all 4 eapol packets they will fail , and sometimes if a capture has lots of other wifi garbage in the .cap file it can confuse the cracking program. This last time was a new situation. After the fail I analyzed the cap file and determined that the essid was not present in the capture. This is absolutely crucial for the decrypting process. In this short article I will show how I determined the essid was not present and what I did about it.