# Detecting WEP Networks

> Scan for legacy WEP-encrypted wireless networks using tools like airodump-ng, identifying weak encryption targets vulnerable to cryptographic attacks.

- **URL:** https://hackindex.io/platforms/wireless/vulnerability-discovery/detecting-wep-networks
- **Path:** Wireless > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/platforms/wireless/vulnerability-discovery.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

WEP (Wired Equivalent Privacy) is a broken encryption standard that was deprecated in 2004 and formally retired by the IEEE in 2012. Its RC4 implementation reuses initialisation vectors in a way that allows the encryption key to be recovered statistically from captured traffic. With sufficient IVs the key can be cracked in minutes regardless of key length. Any network still using WEP is fully compromised once enough frames are captured. Being able to detect WEP wireless networks during reconnaissance is the first step toward confirming this vulnerability.

## Detect WEP Wireless Networks with airodump-ng

```bash
airodump-ng wlan0mon
#  BSSID              PWR  Beacons  CH   MB   ENC   CIPHER  AUTH  ESSID
#
#  AA:BB:CC:DD:EE:FF  -52       74   6   54   WEP   WEP     OPN   OldRouter
#  11:22:33:44:55:66  -61       41  11   54   WEP   WEP     SKA   SecureWEP
#  77:88:99:AA:BB:CC  -44       88   6  130   WPA2  CCMP    PSK   HomeNetwork
```

**WEP** in the ENC column confirms WEP encryption. The AUTH column shows the authentication method:

- **OPN**: open system authentication with WEP. The client authenticates without a challenge. Data frames are still WEP encrypted.
- **SKA**: shared key authentication. The AP sends a cleartext challenge that the client encrypts with the WEP key and returns. SKA leaks the keystream directly and actually makes cracking easier than OPN.

Both variants are crackable with the same IV collection and aircrack-ng approach. SKA networks leak additional keystream material during the authentication exchange which can speed up the attack.

## Confirm with iw

Verify the Privacy capability bit is set and no RSN IE is present, which distinguishes WEP from open networks:

```bash
iw dev wlan0 scan | grep -A 20 "AA:BB:CC:DD:EE:FF" | grep -E "SSID|capability|RSN|WPA"
# SSID: OldRouter
# capability: ESS Privacy ShortSlotTime
```

**Privacy** in the capability field with no RSN or WPA information element confirms WEP. If an RSN IE is also present, the network is WPA or WPA2 despite the Privacy bit being set.

## Check for Connected Clients

WEP cracking is faster with active clients transmitting data frames, which generate IVs. Check whether clients are associated:

```bash
airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 wlan0mon
#  BSSID              PWR  Beacons  #Data  CH  MB   ENC  CIPHER  AUTH  ESSID
#
#  AA:BB:CC:DD:EE:FF  -52       91    842   6  54   WEP  WEP     OPN   OldRouter
#
#  BSSID              STATION            PWR   Rate  Lost  Frames
#
#  AA:BB:CC:DD:EE:FF  CC:DD:EE:FF:AA:BB  -61   11e-1e   0     412
```

The **#Data** column shows how many data frames have been captured. WEP cracking typically requires 40,000 to 85,000 IVs for a reliable key recovery. If no clients are present, ARP replay injection can accelerate IV collection: covered in the exploitation phase.

## Document the Finding

Record the following for each WEP network:

- BSSID and SSID
- Channel
- AUTH type (OPN or SKA)
- Current data frame count
- Whether active clients are associated

A WEP network with active clients is immediately exploitable through passive IV collection followed by aircrack-ng. A WEP network with no clients requires ARP replay injection to generate sufficient IVs.

## References

- [Aircrack-ng: airodump-ng documentation](https://www.aircrack-ng.org/doku.php?id=airodump-ng) - ENC and AUTH column values, data frame counter reference