I'm trying to understand how to find these attacks when using a packet sniffer (specifically using Omnipeek). Is there a way to look at a packet and know that this type attack happened? I want to find various aircrack-ng attacks.

  • It's not about aircrack-ng, but about the attacks. Do you know how a deauth attack works (or any of the other attacks)? There are very distinct patterns that it uses. Have you read the documentation? – schroeder Feb 24 '18 at 8:32

What kind of attack are you talking about? DoS attack? If yes, you should look for deauth frames on your sniffer captured data. Here there is an interesting link about how to filter on wireshark to look for deauth frames: https://packetwrangling.com/2017/11/02/weathering-a-deauth-storm-with-wireshark/

Other kind of attacks like bruteforce against your WPA/WPA2 network are not detectable because they are done offline. The attacker capture the Handshake and then try to crack it offline by bruteforce, dictionary attacks or however. So, there is no trace about this cracking attempts.


While one cannot look at any ordinary packet and determine the history the network like sediment patterns in mountains, one can recognize packets involved in various attacks you may carry out using aircrack-ng.

Regarding detecting the packets involved, I recommend running wireshark while carrying out the attack in order to learn more about the packets used in the attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.