Detecting Wi-Fi de-Auth attacks

MrR · August 2020

I recently moved to a new neighborhood and continually get my WiFi knocked down from De-Auth. How can I detect, log and investigate the source of this attack using the Fing box?

thanks

Robin · August 2020

Thanks @kltaylor
To further update on this @MrR , you need to make sure all access points are added to your Fingbox network and you need try to pass the minimum threshold and see if the Fingbox is able to provide you with an alert or not. You need to try performing deauth attacks at high speed against the BSSID that is monitored by Fingbox. Keep it on for at least 5 minutes.
Our Engineers have tested with aircrak several times and the attack was detected and was reported within 5 minutes with mail and event in fingbox logs.

In order to avoid false alarms, there are minimum thresholds to raise an alarm:
- the minimum duration of attack: 10 seconds
- minimum deauth packets per second: 30/sec

kltaylor · August 2020

Hi @MrR welcome to the community and thanks for asking your question.

What methods are you using to conclude that this is a de-auth attack? Can you provide screenshots so that we can help ascertain what is going on?

MrR · August 2020

@kltaylor to be honest I’m just guessing it’s a deauthorize attack. I’ve reproduced the exact symptoms by deauthing my own equipment. The Fing has not given me any alerts to any new clients connecting. I just moved to this location after buying a house and it happens quit frequently. There is less WiFi activity in this neighborhood than my apartment so I don’t think it’s interference. I’m still engulfed in unpacking from the move. Once I’m settled in I’m going to trouble shoot further.

Detecting Wi-Fi de-Auth attacks

Best Answer

Answers