A field kit for a municipal WLAN assessment lists airodump-ng, aireplay-ng, and aircrack-ng. How should the assessor map each tool to its primary role?
Select an answer to reveal the explanation.
Short Explanation
Picture three different city trucks: one surveys the streets, one nudges traffic along, and one tries the locks back at the shop. airodump watches and records, aireplay can inject or replay frames, and aircrack does the offline key-recovery attempt. Mix those roles up and the kit becomes confusing fast.
Full Explanation
In municipal WLAN assessments the aircrack-ng family is useful only when each binary is mapped to its real job. airodump-ng is the survey and capture utility: it lists BSSIDs, channels, and stations and records traffic into pcap or cap files under authorized Rules of Engagement. aireplay-ng covers injection and replay of selected 802.11 frame classes when the chipset and RoE allow it, including deauthentication or other lab stimuli that force useful handshake material. aircrack-ng is the offline recovery engine that attempts passphrase or key recovery against captured material after the field window closes. Keeping those roles separate protects evidence quality and prevents operators from pointing the wrong tool at the wrong stage of a county engagement. Claiming airodump-ng cracks passphrases while aireplay-ng draws maps and aircrack-ng only sets monitor mode fails by concept: it swaps capture, injection, and cracking functions and invents a mapping role aireplay-ng does not own. Treating airodump-ng as a wpa_supplicant configurator, aireplay-ng as a DHCP manager, and aircrack-ng as a beacon-only capture tool fails by concept: those are client association and IP-stack concerns, not the suite’s RF capture, inject, and offline-crack pipeline. Saying airodump-ng only injects deauth, aireplay-ng decrypts WPA2 live, and aircrack-ng replaces Wireshark fails by concept: deauth injection is not airodump-ng’s primary role, live WPA2 decryption is not aireplay-ng’s job, and protocol analysis remains a separate analyzer class. Exam caveat: suite names are overloaded—aircrack-ng is both the project umbrella and the cracker binary—so read the stem for which role is asked and never assume one binary does survey, inject, and crack. Operational check: on the municipal assessment laptop, confirm airodump-ng is writing authorized captures, that any aireplay-ng use is explicitly allowed and channel-locked, and that aircrack-ng runs offline against labeled evidence with passphrase findings logged to the engagement notes rather than improvised live misuse.