There is a single MAC address broadcasting a vast amount of QoS packets on channels between 3 and 9. Is this a DoS attack?

The access point that MAC address is associated with says its on channel 1.

I have been using airodump-ng to check on single channels and all channels. When opening the .pcap files in Wireshark, I can see massive amounts of null QoS packets from that MAC address on the middle range of all channels.

Another odd thing is the signal strength (PWR) of that MAC address broadcasting all those QoS messages is fluctuating massively (between -70 and -30), so would be difficult to pinpoint the device by using some hunter software and judging where the signal is strongest. Is this deliberate?

More information

The station causing the masses of frames is 40:CD:7A:CD:33:2A.
The BSSID it is associated with is 48:D3:43:76:63:89 and reports being on channel 1.

I wrote a script to hop airodump-ng through all channels for 60 seconds per channel. Here is the number of frames generated by the problematic station:

Channel  Packets

1        2
2        0
3        583        
4        1016
5        46099
6        80485
7        58611
8        1743
9        1779
10       32
11       2
12       0
13       0

The packets are a mix of QoS Null packets and Deauthentications from the BSSID to the problem device. The device still keeps sending QoS Null packets.

To put it into context, in 1 minute on one of the bad channels, the offending device is using an order of magnitude more frames than entire sum of traffic an all of the channels, and it is doing that simultaneously on 3 channels. This is killing the channel 6 band completely!

There seem to be 3 possibilities:

  1. Virgin Media superhub3 using a 2.4 ghz channel to do its 5ghz QoS stuff

  2. The kiddy who owns the hub is a hacker... and further plays on that theme/framing/association

  3. Someone else is spoofing using packet injection

  • The way the data is arranged makes me suspect that channel 6 is targeted and the other frequencies just "bleed through". That's why in regular use, it's suggested to spread channel use as far apart as possible, since e.g. channel 6 can bleed into channels 5 and 7. – MechMK1 Apr 12 '19 at 12:44
  • On a further note, are you saying that some of the packets on 5 and 7 are duplicates of packets on 6 ? Or would it not spread it because band 6 on some routers may use 2 or 3 channels doubling or tripling the bandwidth? – SkyPi Apr 12 '19 at 14:30
  • As you can see, there is not much to go on by just counting frames. DoS is defined by intent, and without more data about what is actually in those frames, we can only guess as to what's going on. You have a network troubleshooting scenario at the moment, not a security issue, yet. – schroeder Apr 12 '19 at 19:27
  • 1
    If the -70 to -30 range is expressed in dBm, that's a massive difference. 40 dB is a factor 10000 difference in received power. – a CVn Apr 12 '19 at 20:17
  • Do NOT edit in commentary into your question. And do NOT insult people who are trying to make some sense of your question. – schroeder Apr 13 '19 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.