aireplay-ng --arpreplay waits for ARP packets, captures them and then injects them as it pleases. Assuming the network traffic is encrypted by WEP or whatever how can aireplay-ng identify an ARP packet in the first place? When i look at traffic in Wireshark don't see any evidence of ARP unless i decrypt traffic.
WEP CRACKING
Weak IVs : Weak Ivs are ivs which reveal information about the wep key itself
RC4 in its implementation in WEP has been found to have weak keys. Having a weak key means that there is more correlation between the key and the output than there should be for good security. Determining which packets were encrypted with weak keys is easy because the first three bytes of the key are taken from the IV that is sent unencrypted in each packet. This weakness can be exploited by a passive attack. All the attacker needs to do is be within a hundred feet or so of the AP.
Out of the 16 million IV values available, about 9000 are interesting to the most popular attack tool, meaning they indicate the presence of weak keys. The attacker captures “interesting packets”, filtering for IVs that suggest weak keys. After that attacker gathers enough interesting packets, he analyzes them and only has to try a small number of keys to gain access to the network. Because all of the original IP packets start with a known value, it’s easy to know when you have the right key. To determine a 104 bit WEP key, you have to capture between 2000 and 4000 interesting packets. On a fairly busy network that generates one million packets per day, a few hundred interesting packets might be captured. That would mean that a week or two of capturing would be required to determine the key
now lets come to your question
how can aireplay-ng identify an ARP packet ?
yes the packets are encrypted but ARP request packets are always of fixed size 28 bytes , so by looking at DOT11 frame header having broadcast address and payload of fixed size arp requests are detected
Hope you got what you were looking for