I recently got myself a router to experiment with wireless security. I'm using the
aircrack-ng suite to collect IVs with the goal of cracking the key. As part of the process, I'm use the following to perform an ARP replay attack:
aireplay-ng -3 -e <AP ESSID> -h <client MAC> <interface>
I leave that running, and in another terminal window I perform a de-authentication attack using the following to de-authenticate my phone (which is the connected client I am testing with):
aireplay-ng --deauth 1 -e <AP ESSID> -c <client MAC> <interface>
After running the ARP replay attack, I can de-authenticate my phone once and it will reconnect. If I attempt to de-authenticate it again, it will disconnect as expected, but the AP will disappear from my phone's Wi-Fi list. It won't return until I terminate the ARP replay attack. Interestingly, if I leave the attack running and instead turn off my phone's Wi-Fi, I see this in the output:
Notice: got a deauth/disassoc packet. Is the source MAC associated ?
That reads to me as if my phone is connected, and turning it off has disconnected me. Yet if this is the case, my phone doesn't show it.
Why does a second de-authentication attack give the illusion that my phone can't find the AP?