Kismet + Aircrack = Kismet-PTW Plugin
dr
After saying for a while that the PTW attack was awesomely quick, so much so 
that including it as a passive "might as well try" in Kismet was reasonable, the
kismet-ptw plugin for kismet-newcore does just that.

Kismet is still passive ONLY.  It will not inject spoofed frames to accelerate
the attack.

This code is not included in Kismet by default.  It must be enabled by the user
by compiling it separately.

<code>
1.  What is Kismet-PTW
2.  Caveats
3.  Compiling
4.  Installing

1.  What is Kismet-PTW

	Kismet-PTW is a Kismet plugin which performs the Aircrack-NG PTW attack
	against data captured by Kismet.

	The Aircrack-NG PTW attack exploits flaws in WEP to expose the original
	keystream.  Because the PTW attack needs relatively few packets (50,000
	to 100,000) and is relatively CPU cheap, it makes sense to include this
	as an automatic feature.

	While Aircrack-NG can use injection to accelerate the rate at which
	packets are generated, increasing the chances of deriving the key, the
	Kismet-PTW version is 100% passive.  Kismet will NOT inject packets or
	actively attack a network, with this plugin it will simply examine the
	data it has already recorded.

	The code for the PTW attack is directly extracted from Aircrack-NG, this
	plugin simply wraps the Aircrack-NG library into a form Kismet can use
	directly.  For complete info about the PTW attack or Aircrack, see the
	Aircrack-NG project at:
		http://www.aircrack-ng.org

2.  Caveats

	Memory Usage
	  Because this plugin needs to store fragments of the packet data, it
	  can dramatically increase the amount of memory Kismet uses.  Memory
	  usage is mitigated with timeout factors; if a network generates no WEP
	  data in 30 minutes, the existing WEP data will be forgotten.

	CPU Usage
	  Similarly, this will cause the CPU requirements of Kismet to rise
	  considerably.  The PTW calculations are run only at intervals when
	  there have been sufficient new packets (1000 packets of known types
	  and 5000 packets of unknown types), but during the calculations the
	  load may be considerable.

	Packet Generation
	  Kismet will not spoof packets or cause the network to increase the
	  generation of packets.  This may prevent the attack from working as
	  quickly (or at all), depending on the network traffic generated by a
	  network.

	Usage and Legality
	  Using this against a network that is not your own is a Bad Idea.

	  No support will be given for using this plugin as a means to gain
	  access to a network.

3.  Compiling

	Compiling the Kismet-PTW plugin requires the Kismet source be installed
	and configured.

	By default, Kismet-PTW expects the Kismet source to be in
	/usr/src/kismet-newcore; this can be overridden by setting the
	KIS_SRC_DIR environment variable:

		cd plugin-ptw/
		KIS_SRC_DIR=/home/foo/src/kismet-newcore make

4.  Installing

	Kismet plugins may be installed system-wide in the plugins directory (by
	default, /usr/local/lib/kismet/) or in the users home directory
	(~/.kismet/plugins)

	The default installation path can be overridden with the KIS_DEST_DIR
	variable:
		cd plugin-ptw/
		KIS_DEST_DIR=/usr make install
</code>