Skip to content


Airdecloak-ng is a tool that removes wep cloaking from a pcap file. Some WIPS (actually one) actively “prevent” cracking a WEP key by inserting chaff (fake wep frames) in the air to fool aircrack-ng. In some rare cases, cloaking fails and the key can be recovered without removing this chaff. In the cases where the key cannot be recovered, use this tool to filter out chaff.


 airdecloak-ng [options]


-i<input file>Path to the capture file. 
–bssid<BSSID>BSSID of the network to filter. 
–ssid<ESSID>ESSID of the network to filter (not yet implemented). 
–filters<filters>Apply theses filters in this specific order. They have to be separated by a ‘,’.
Example: –filters signal,consecutive_sn 
–null-packetsnoneAssume that null packets can be cloaked (not yet implemented). 
–disable-base_filternoneDisable the base filter.
–drop-fragnoneDrop all fragmented packets. In most networks, fragmentation is not needed.