Skip to content
HackIndex logo

HackIndex

Detecting WEP Networks

3 min read Mar 17, 2026

WEP (Wired Equivalent Privacy) is a broken encryption standard that was deprecated in 2004 and formally retired by the IEEE in 2012. Its RC4 implementation reuses initialisation vectors in a way that allows the encryption key to be recovered statistically from captured traffic. With sufficient IVs the key can be cracked in minutes regardless of key length. Any network still using WEP is fully compromised once enough frames are captured.

Identify WEP Networks with airodump-ng

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 BSSID              PWR  Beacons  CH   MB   ENC   CIPHER  AUTH  ESSID

 AA:BB:CC:DD:EE:FF  -52       74   6   54   WEP   WEP     OPN   OldRouter
 11:22:33:44:55:66  -61       41  11   54   WEP   WEP     SKA   SecureWEP
 77:88:99:AA:BB:CC  -44       88   6  130   WPA2  CCMP    PSK   HomeNetwork

WEP in the ENC column confirms WEP encryption. The AUTH column shows the authentication method:

  • OPN — open system authentication with WEP. The client authenticates without a challenge. Data frames are still WEP encrypted.
  • SKA — shared key authentication. The AP sends a cleartext challenge that the client encrypts with the WEP key and returns. SKA leaks the keystream directly and actually makes cracking easier than OPN.

Both variants are crackable with the same IV collection and aircrack-ng approach. SKA networks leak additional keystream material during the authentication exchange which can speed up the attack.

Confirm with iw

Verify the Privacy capability bit is set and no RSN IE is present, which distinguishes WEP from open networks:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 20 "AA:BB:CC:DD:EE:FF" | grep -E "SSID|capability|RSN|WPA" 
SSID: OldRouter
capability: ESS Privacy ShortSlotTime

Privacy in the capability field with no RSN or WPA information element confirms WEP. If an RSN IE is also present, the network is WPA or WPA2 despite the Privacy bit being set.

Check for Connected Clients

WEP cracking is faster with active clients transmitting data frames, which generate IVs. Check whether clients are associated:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 wlan0mon 
 BSSID              PWR  Beacons  #Data  CH  MB   ENC  CIPHER  AUTH  ESSID

 AA:BB:CC:DD:EE:FF  -52       91    842   6  54   WEP  WEP     OPN   OldRouter

 BSSID              STATION            PWR   Rate  Lost  Frames

 AA:BB:CC:DD:EE:FF  CC:DD:EE:FF:AA:BB  -61   11e-1e   0     412

The #Data column shows how many data frames have been captured. WEP cracking typically requires 40,000 to 85,000 IVs for a reliable key recovery. If no clients are present, ARP replay injection can accelerate IV collection — covered in the exploitation phase.

Document the Finding

Record the BSSID, SSID, channel, AUTH type (OPN or SKA), current data frame count, and whether active clients are present. A WEP network with active clients is immediately exploitable through passive IV collection followed by aircrack-ng. A WEP network with no clients requires ARP replay injection to generate sufficient IVs.

References