Hi, seems that wpaclean utility only saves the last network/handshake it sees to the output file. Attached patch fixes it. PR already reported upstream.
OK? cheers, Sebastian Index: Makefile =================================================================== RCS file: /cvs/ports/security/aircrack-ng/Makefile,v retrieving revision 1.22 diff -u -r1.22 Makefile --- Makefile 23 Feb 2019 22:23:25 -0000 1.22 +++ Makefile 7 Mar 2019 22:25:31 -0000 @@ -2,6 +2,7 @@ COMMENT= 802.11 WEP and WPA-PSK keys cracking program DISTNAME= aircrack-ng-1.5.2 +REVISION= 0 CATEGORIES= security HOMEPAGE= https://www.aircrack-ng.org/ Index: patches/patch-src_wpaclean_c =================================================================== RCS file: patches/patch-src_wpaclean_c diff -N patches/patch-src_wpaclean_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-src_wpaclean_c 7 Mar 2019 22:25:31 -0000 @@ -0,0 +1,21 @@ +$OpenBSD$ + +prevent wpaclean from overwriting the outputfile +with next capture each time a new capture is found +in a source file + +Index: src/wpaclean.c +--- src/wpaclean.c.orig ++++ src/wpaclean.c +@@ -138,7 +138,10 @@ static void save_network(const struct network * n) + { + int i; + +- _outfd = open_pcap(_outfilename); ++ if (_outfd == 0) ++ { ++ _outfd = open_pcap(_outfilename); ++ } + write_pcap(_outfd, n->n_beacon, n->n_beaconlen); + + for (i = 0; i < 4; i++)
