I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).
It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets. This would make sense, as I need to capture an ARP packet in order to perform aircrack-ng's ARP request replay attack.
This changes when I switch my AP to WEP-Open. When I perform the replay attack, I see the ARP packets on the test client as expected. But when I generate ARP requests on the client (i.e. pinging a nonexistent IP address), the corresponding 802.11 data frames that my attacking machine picks up appear to be encrypted. The hex data of each data frame is different for each data frame.
Why can't I see the unencrypted frames?