I highly recommend anyone who wants to use Reaver to read the documentation at least once.
It's really small and will teach you how to use the tool effectively.
I usually use the --dh-small switch to speed things up.
Delay set to 2, Just to avoid suspicion.
I add a lock delay of 250.
And I add the --no-nacks switch.
And a Fail wait switch incase it times-out on connections.
And finally an --eap-terminate switch.
So it total my command is..
reaver -i mon0 -b xx.xx.xx.xx.xx --dh-small -d 2 --lock-delay=250 --no-nacks --fail-wait=350 --eap-terminate
This seems to run smoothly with no errors.
I don't add verbosity unless I get segementation errors.
I also found out, (I could be wrong on this) that you be to be authorised on the network, sort of like what airplay-ng does with the handshake, I'm not sure if you need someone on the network for this, so you can de-auth them.
But I prefer to run airplay-ng and auth myself, then add the -A switch to reaver. (This is if I was to attack another network)
If you're on ya own network, it's just a case of being connected to it while PIN cracking, so you can brute it.
I could be completely wrong though.
