Detecting Wi-Fi de-Auth attacks

MrR Member Posts: 2
Name Dropper First Comment Photogenic

I recently moved to a new neighborhood and continually get my WiFi knocked down from De-Auth. How can I detect, log and investigate the source of this attack using the Fing box?



Best Answer

  • Robin_from_Fing
    Robin_from_Fing Administrator, Fing Team Posts: 4,761
    250 Answers 2500 Comments 500 Likes 100 Awesomes
    #2 Accepted Answer
    Thanks @kltaylor
    To further update on this @MrR , you need to make sure all access points are added to your Fingbox network and you need try to pass the minimum threshold and see if the Fingbox is able to provide you with an alert or not. You need to try performing deauth attacks at high speed against the BSSID that is monitored by Fingbox. Keep it on for at least 5 minutes.
    Our Engineers have tested with aircrak several times and the attack was detected and was reported within 5 minutes with mail and event in fingbox logs.

    In order to avoid false alarms, there are minimum thresholds to raise an alarm:
    - the minimum duration of attack: 10 seconds
    - minimum deauth packets per second: 30/sec


  • kltaylor
    kltaylor Member, Beta Tester Posts: 1,231
    1000 Comments 500 Likes 50 Answers 100 Awesomes
    Hi @MrR welcome to the community and thanks for asking your question.
    What methods are you using to conclude that this is a de-auth attack?  Can you provide screenshots so that we can help ascertain what is going on?
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • MrR
    MrR Member Posts: 2
    Name Dropper First Comment Photogenic

    @kltaylor to be honest I’m just guessing it’s a deauthorize attack. I’ve reproduced the exact symptoms by deauthing my own equipment. The Fing has not given me any alerts to any new clients connecting. I just moved to this location after buying a house and it happens quit frequently. There is less WiFi activity in this neighborhood than my apartment so I don’t think it’s interference. I’m still engulfed in unpacking from the move. Once I’m settled in I’m going to trouble shoot further.