WEP cracking with aircrack-ng

Open three terminals

terminal 1:
$airodump-ng -c 4 --bssid FA:KE:FA:KE:FA:KE -i -w jah eth1

This is an exmaple that dumps only weak iv's (channel 4) interface eth1 from the AP with this particular BSSID

You can also do a scan for WEP AP's first by running "airodump-ng eth1" without any further args.

If you're seeing some traffic between the AP and the client (use bssid for reference). use aireplay like this (in the second terminal):

$aireplay-ng -3 -b FA:KE:FA:KE:FA:KE -h FA:KE:FA:KE:FA:KE eth1

the three means you're doing ARP. The -b is the AP. The -h is the client.

If you leave this running for some time you can use the third terminal to run aircrack on the .ivs file airodump-ng created. It'll try to crack the key every now and then so you can leave it running.