Forum Thread: Confused Noob

A few things you can do (assuming you're using Kali):

Open up a terminal and run from the command line:

wpaclean new.cap old.cap

Note that the order in this is the opposite of what you'll usually see -- enter the file name you want to give your clean cap file FIRST, and then the file of the one you have now. e.g.

wpaclean SmallCap.cap HugeCapBecauseILeftAirCrackRunning.cap

This will strip the file down to only the relevant handshakes (you only need two from each set, but they have to be the right two).

pyrit -r Old.cap -o New.cap strip

This will strip it down to just handshakes, but won't pre-select them for you.
After that you can run:
pyrit -r New.cap analyze

This will return a list of all handshakes, and tell you if they're usable ("good spread") or not.

And, finally, you can do it manually by opening the cap file in wireshark and selecting individual packets. See this for an explanation:

http://aircrack-ng.org/doku.php?id=wpa_capture&DokuWiki=074d5917c87bb3032d8c42de85f2e8da

Caveat:

I've only ever used these on cap files that captured handshakes from a single ESSID. Not certain how they'll work if you have dozens of different ESSIDs in there.

What I've done is run pyrit strip on the cap file first, run pyrit analyze on it, and then run it through wpaclean. Then I'll open up the final cap file in wireshark and make sure they all look good. But I think you can get away with just wpaclean.