A router (or one spoofing as a router) unilaterally sent to a client an EAPOL packet 1 of 4, and then immediately sent 5 packets of EAPOL packet 3 of 4.

Is this the signature of a KRACK attack? And if so, how would I know if the attack (and spoofed connection) was successful or failed.

  • 1
    Possibly. Or it could be normal operation. Or it could be something else entirely. There really isn't enough information in your question to provide any sort of positive statement stating exactly what is happening. Could you provide a packet capture showing the behavior? That at least would be somewhere to start looking into the behavior.
    – YLearn
    Nov 14, 2019 at 4:12


You must log in to answer this question.

Browse other questions tagged .