I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets. This would make sense, as I need to capture an ARP packet in order to perform aircrack-ng's ARP request replay attack.

This changes when I switch my AP to WEP-Open. When I perform the replay attack, I see the ARP packets on the test client as expected. But when I generate ARP requests on the client (i.e. pinging a nonexistent IP address), the corresponding 802.11 data frames that my attacking machine picks up appear to be encrypted. The hex data of each data frame is different for each data frame.

Why can't I see the unencrypted frames?

1 Answer 1


Because they're encrypted

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets.

Nope. Instead the attack relies on the very fact that they ARE encrypted.

From the aircrack-ng docs:

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably.
The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.

  • How can I listen for ARP packets to retransmit back to the AP if they are encrypted?
    – david
    Commented Jan 18, 2017 at 15:02
  • 1
    @david: they stand out because of their size. Commented Jan 18, 2017 at 15:20
  • Thanks for clearing that up. Found several answers on the site saying ARP is not encrypted, but your answer makes perfect sense.
    – david
    Commented Jan 18, 2017 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .