I recently got myself a router to experiment with wireless security. I'm using the aircrack-ng suite to collect IVs with the goal of cracking the key. As part of the process, I'm use the following to perform an ARP replay attack:

aireplay-ng -3 -e <AP ESSID> -h <client MAC> <interface>

I leave that running, and in another terminal window I perform a de-authentication attack using the following to de-authenticate my phone (which is the connected client I am testing with):

aireplay-ng --deauth 1 -e <AP ESSID> -c <client MAC> <interface>

After running the ARP replay attack, I can de-authenticate my phone once and it will reconnect. If I attempt to de-authenticate it again, it will disconnect as expected, but the AP will disappear from my phone's Wi-Fi list. It won't return until I terminate the ARP replay attack. Interestingly, if I leave the attack running and instead turn off my phone's Wi-Fi, I see this in the output:

Notice: got a deauth/disassoc packet. Is the source MAC associated ?

That reads to me as if my phone is connected, and turning it off has disconnected me. Yet if this is the case, my phone doesn't show it.

Why does a second de-authentication attack give the illusion that my phone can't find the AP?

  • 1
    Maybe it's a security measure by the phone manufacturer. The notice is the default message because if you turn off your phone (or the Wi-Fi) it sends a deauth to tell the router to disassociate hence disabling the ARP attack. – Azteca Jan 25 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.