0

I'm suspecting that my neighbor is running multiple Wifi deauth flood attacks against my Wifi. I'm using WPA2 and I don't think he can really crack my password, but my devices keep having wifi connection problems.

I want to know: a) How can I detect and prove that yes, Deauth flood is going on against my AP?

b) How can I prevent it?

2

How do I know if i'm being attacked?

Detection of de-auth frames can be difficult to spot, you'll need software like nzyme (which is WI-FI monitoring software) along with something like Graylog, a WI-FI security management tool. Graylog enables you to analyze the wireless traffic hitting your network. You'll find a much better explanation of each by just Googling the above software.

The above may help you identify if you are the target of such attacks.

Prevention

With regards to preventing it, there is no definite way of preventing de-authentication attacks.

If your AP supports it, you can enable 802.11w which increases the security of management frames and can assist with preventing these types of attacks, move info here:(802.11w)

Some people may suggest hiding your SSID. If your neighbor has a network card capable of injecting packets along with the know-how to send de-auth attacks, chances are he'll be able to suss out and discover you've hidden your SSID pretty quickly.

I can appreciate the pure annoyance of this is the entire point of wanting to block these attacks, however, these types of attacks can be much more devastating in somewhere like a coffee shop for instance, so I wouldn't be too concerned with regards to network security. (This doesn't take away from the fact this person still of course has the ability to try capturing the handshake and attempting a brute-force, see below for suggestion on how to near-eradicate this worry).

Suggestion

If this is your home network the best thing you can do if you are worried would be to create a strong, long password. Generate a 20 char one if needs be, just don't forget it!

  • Can I detect the attack with Wireshark? Is this illegal in US? I can maybe collect evidence with Wireshark and contact FCC? – GMX Rider Mar 15 at 16:23
  • @GMXRider - Wireshark can detect those types of packets, typing the below into the filter enables you to target these packets specifically : wlan.fc.type_subtype == 0x0C – Tipping44 Mar 15 at 20:35
  • Thank you, final question, is deauth flooding illegal in US? – GMX Rider Mar 16 at 0:02
  • I don't reside in the US so i can do nothing more than Google, but i found this this – Tipping44 Mar 16 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.