WLAN IP address assignment/WEP attack

[chipzoller]

In experimenting around with WEP attacks and WLAN intrusion methods, I'm wondering once the WEP key has been discovered and a client can associate with the WAP (assuming no MAC filtering activated) but no DHCP is turned on, how does the client know which subnet to put himself in in order to assign himself a valid static IP? I've not been able to find any info. on this bit of WEP intrusion; all docs. seem to stop and assume once the WEP key has been discovered that DHCP is automatically turned on at the WAP.

[squid_80]

Once you know the key you can decrypt sniffed packets to see what ip addresses are being used, and assign yourself one that is close by. Or just go all out, fake your MAC address to be the same as an observed one and take over an existing IP (this gets around MAC filtering).