UGN Security Forums UGN Security: Knowledge Base Operating Systems Windows & Windows Security Cain vs. JtR

Is it normal for (while working on LM hashes) Cain to be running at ~7.8mil passes/sec while JtR is only able to do about 2mil passes/sec (i am assuming that is what "c/s" measures). The number JtR gives seems to scale according to how many hashes it is working on at a given time, but when only working on two (split LM hash) shouldn't the two give about the same speed? It just seems odd that JtR, which seems to be so popular, would not be slower than a built-in cracker in Cain.

John is much better against larger targets:

IBM T41 1400 Celeron latpop, XP pro
John 1.6.37 bigpatch 9, compiled from source with assembler options
Cain 2.66

Brute force alpha modes

One account (2 NT hashes) was about the same - 3.4 million/sec
800 accounts, Cain 1.8 million, JtR 2600 million

Time trial with 800 accounts, 20 seconds, Cain :130 hashes, JtR 280 hashes

If you have a lot to crack, go for JtR.
Cain and John can also crack hash types that the other cannot, so right tool for the job applies

Since there are lies, damn lies and statistics, easiest comparison is a full time trial to get all passwords as per second stats can be massively skewed dependant on how the cracking algo's are implemented, how you use them etc - John for example, has greatly increased speeds when you use the modes properly, rather than just type 'john users.dat' for example, which probably gives the worst results.