I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have a 2.4 GHz interface and also a 5GHz one.
I have successfully deauthenticated users from the 2.4 GHz interface and they jumped to the 5 GHz one.
The problem comes when I try to deauth them from the 5Ghz. Expectations are that they will jump back to the 2.4Ghz frequency or they will be temporarily deauth, but neither case appears to be happening from my understanding.
When I am running the deauth attack I constantly receive acknowledgements of deauth (or ACKs) from both the targeted AP and targeted victim's MAC but the connection to the internet is still alive and no interference is noticed in the targeted machine. I am thinking that the AP monitors the deauth incoming packets and if there is a larger sequence it will deflect it but this should be replicated on the 2.4 GHz interface too.
Is this due to something within the 5 GHz protocol - does the re-connection from the 5 GHz happen too fast for the victims machine to notice? Is it backwards compatible? (I mean, does the jump from 5 to 2.4 is actually real and can happen ?)
Note: The tests are done correctly with the correct devices and tools (mdk3, aireplay and other custom made tools) according to the requirements laid out in their respective manuals.