I want to create a honeypot that will detect KRACK attacks. Is there any way to detect that kind of attack, are there any traces, any information that is stored in log files (syslog for example) that tells: "You are under KRACK attack"?
A WiFi card in monitor mode will (given the right circumstances, id est in range of the client, the AP and the attacker) pick up the repeated third step of the handshake.
A filter rule could find such packets and trigger an alert.
There’s nothing in (usually configured) logs or otherwise persistent to the attack itself.
This is not a straight answer but can help a lot in your case, I believe. Here is a script that can detect if your WIFI AP is vulnerable to HRACK :
The script was made by one of the original authors of KRACK.