I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets. This would make sense, as I need to capture an ARP packet in order to perform aircrack-ng's ARP request replay attack.

This changes when I switch my AP to WEP-Open. When I perform the replay attack, I see the ARP packets on the test client as expected. But when I generate ARP requests on the client (i.e. pinging a nonexistent IP address), the corresponding 802.11 data frames that my attacking machine picks up appear to be encrypted. The hex data of each data frame is different for each data frame.

Why can't I see the unencrypted frames?


Because they're encrypted

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets.

Nope. Instead the attack relies on the very fact that they ARE encrypted.

From the aircrack-ng docs:

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably.
The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.

|improve this answer|||||
  • How can I listen for ARP packets to retransmit back to the AP if they are encrypted? – david Jan 18 '17 at 15:02
  • 1
    @david: they stand out because of their size. – StackzOfZtuff Jan 18 '17 at 15:20
  • Thanks for clearing that up. Found several answers on the site saying ARP is not encrypted, but your answer makes perfect sense. – david Jan 18 '17 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.