A malicious user is sniffing a busy encrypted wireless network waiting for an authorized client to connect to it. Only after an authorized client has connected and the hacker was able to capture the…

An IV (Initialization Vector) attack targets WEP's weak IV implementation by collecting large numbers of packets to statistically derive the key - it does not require capturing a client handshake.

WEP cracking relies on collecting weak IVs from large amounts of captured traffic to derive the RC4 key, and does not depend on capturing an authenticated client handshake with the AP.

WPA and WPA2 use a four-way handshake during client authentication that contains enough information for an attacker to perform an offline dictionary or brute force attack against the pre-shared key. The attacker must passively wait for a legitimate client to associate with the AP to capture this handshake. Once captured, cracking is performed offline against the handshake data, making this the defining characteristic of a WPA/WPA2 cracking attack.

A Rogue AP attack involves setting up a fraudulent access point to intercept client traffic - in this scenario the attacker is passively monitoring a legitimate network, not creating a fake one.