There is a single MAC address broadcasting a vast amount of QoS packets on channels between 3 and 9. Is this a DoS attack?
The access point that MAC address is associated with says its on channel 1.
I have been using airodump-ng to check on single channels and all channels. When opening the .pcap files in Wireshark, I can see massive amounts of null QoS packets from that MAC address on the middle range of all channels.
Another odd thing is the signal strength (PWR) of that MAC address broadcasting all those QoS messages is fluctuating massively (between -70 and -30), so would be difficult to pinpoint the device by using some hunter software and judging where the signal is strongest. Is this deliberate?
The station causing the masses of frames is
The BSSID it is associated with is
48:D3:43:76:63:89 and reports being on channel 1.
I wrote a script to hop airodump-ng through all channels for 60 seconds per channel. Here is the number of frames generated by the problematic station:
Channel Packets 1 2 2 0 3 583 4 1016 5 46099 6 80485 7 58611 8 1743 9 1779 10 32 11 2 12 0 13 0
The packets are a mix of QoS Null packets and Deauthentications from the BSSID to the problem device. The device still keeps sending QoS Null packets.
To put it into context, in 1 minute on one of the bad channels, the offending device is using an order of magnitude more frames than entire sum of traffic an all of the channels, and it is doing that simultaneously on 3 channels. This is killing the channel 6 band completely!
There seem to be 3 possibilities:
Virgin Media superhub3 using a 2.4 ghz channel to do its 5ghz QoS stuff
The kiddy who owns the hub is a hacker... and further plays on that theme/framing/association
Someone else is spoofing using packet injection