I want to create a honeypot that will detect KRACK attacks. Is there any way to detect that kind of attack, are there any traces, any information that is stored in log files (syslog for example) that tells: "You are under KRACK attack"?


2 Answers 2


A WiFi card in monitor mode will (given the right circumstances, id est in range of the client, the AP and the attacker) pick up the repeated third step of the handshake.

A filter rule could find such packets and trigger an alert.

There’s nothing in (usually configured) logs or otherwise persistent to the attack itself.

  • APs should also be able to alert when frames with the zero-key encrypted are received. This would indicate vulnerable Android clients (but might happen without attack)
    – eckes
    Oct 26, 2017 at 9:56
  • Yes, but that’d be a firmware feature that’s not going to be commonplace. And it would only detect parts of the attack.
    – Tobi Nary
    Oct 26, 2017 at 9:57
  • Is there a smartphone app that i can install for iPhone (tm) that will monitor and alert me? Oct 26, 2017 at 12:34
  • @AndyzSmith not as far as I know. And if there is, it’s only for jailbroken iPhones, which brings in a load of other problems. That’s because you do not have access to the hardware as directly as you need within the API.
    – Tobi Nary
    Oct 26, 2017 at 12:47
  • Any smartphone? Code for Arduino with wifi shield? Oct 26, 2017 at 13:02

This is not a straight answer but can help a lot in your case, I believe. Here is a script that can detect if your WIFI AP is vulnerable to HRACK :

This script tests if APs are affected by CVE-2017-13082 (KRACK attack)

The script was made by one of the original authors of KRACK.

  • Thank You, I know that script and I have been using it, but it don't anwser my needs.
    – bartekch
    Oct 26, 2017 at 10:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .