Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?

Question

I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets. This would make sense, as I need to capture an ARP packet in order to perform aircrack-ng's ARP request replay attack.

This changes when I switch my AP to WEP-Open. When I perform the replay attack, I see the ARP packets on the test client as expected. But when I generate ARP requests on the client (i.e. pinging a nonexistent IP address), the corresponding 802.11 data frames that my attacking machine picks up appear to be encrypted. The hex data of each data frame is different for each data frame.

Why can't I see the unencrypted frames?

Answer 1

Because they're encrypted

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets.

Nope. Instead the attack relies on the very fact that they ARE encrypted.

From the aircrack-ng docs:

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably.
The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.