When attacking WEP, one must use a wireless card which supports packet injection. I have two questions about this.

(1) As long as we have a busy network, why would we need packet injection? I thought the sole purpose of packet injection is to increase network traffic. If we already have enough traffic, we should not need injection. In other-wards, why is the packet injection feature made a requirement when it seems to be something optional?

(2) Packet injection seems to be done via ARP packets -- i.e., the attacker sends spoofed ARP packets to the AP. Now, when one sends out an ARP packet, the reply is an ARP packet (and I believe the returned ARP packets are not encrypted). Since ARP packets are not encrypted, how does their generation help speed up the attack? I thought the attack is speeded up by the availability of more encrypted packets as opposed to just the availability of more packets.

  • Apparently, you need to read a book or google the basic of WEP weakness and gather knowledge how decrypt works on weak encryption.
    – mootmoot
    Aug 22, 2016 at 16:00
  • Its obvious that what I am asking for is beyond WEP 101.
    – Minaj
    Aug 22, 2016 at 16:01
  • How about the second one I mentioned : cracking weak encryption?Basic encryption cracking 101 : inject massive KNOWN data and detect the pattern to reverse the key.
    – mootmoot
    Aug 22, 2016 at 16:05
  • I think you are taking a very simplistic view to the question. Have you taken a moment to think of how such an injection would work? You dont just inject random data to an AP with which you are not associated. It takes a special type of packets, and even then , the underlying mechanism is not as simple as what you are trying to portray it. I would say you watch the question and wait for the experts to weigh in on it. FYI -- I already have the attack working. I just want to get the full dynamics.
    – Minaj
    Aug 22, 2016 at 16:19
  • Well, unless you change your phrase to clarify the meaning of busy network . Are those traffic come from your injection ? Or it is others people network traffics. You are contradicting when you say injection is not required,but the busy traffics is indeed cause by your injection!. you response just show further contradiction.
    – mootmoot
    Aug 22, 2016 at 16:29

1 Answer 1


(1) You are correct, if you have traffic on the AP you're sniffing you can get enough IV just beeing passive, there's no need to inject ARP request to generate new IV to crack WEP.

(2) The encryption is done at the network layer, ARP is on the data-link layer, so no, it's not encrypted, as stated in it's definition RFC826 ARP is broadcast, so why would you even want to encrypt it? Sorry for the misleading answer / wrong information.

(2) ARP response packets actually are encrypted and this is actually how it helps with the generation of IVs.

How ARP Request Replay Attack works:

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.

So basically you just listen for ARP and then retransmits it so generate more IVS enought to crack WEP.

  • But I thought IVs are only used for encrypted packets since they are used to produce the keystream used for encryption. If ARP is not encrypted, how does it get to require IVs to be generated?
    – Minaj
    Aug 23, 2016 at 6:54
  • You are right, IVs + key are the seed for RC4 to generate the keystream to encrypt the data, but you are just sniffing everything encrypted and pointpicking the IVs, plus you don't need specifically ARP to generate new IVs, you can also use aireplay-ng -2 which is interactive frame selection and you would still get IV from the AP. You just want the AP to replay to whatever, that new whatever is legitimate and hence has new IVs.
    – Azteca
    Aug 23, 2016 at 18:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .