1

My neighbour is actively trying WPS pins on my router - I know because the "WiFi/WPS" LED on my router lit up when I have permanently turned it off! I double checked the setting using the router admin page through ethernet and it confirmed LED's were off (except during WPS negotiation, which overrides the off setting). Note, it's a Tenda AC10 router.

Additionally all my 5Ghz devices got disconnected, I'm not sure if it's because of aggressive WPS packets or a simultaneous deauth flood was issued.

I need to track down the WPS packets and pin-point the MAC address the attempts were issued from. I tried using the "WPS" display filter in Wireshark as well as the "eap.wps.code" filter, no packets were found AS the packets were being recorded!

The same also occurred a couple of days back when I was trying WPS attempts against my own device and couldnt see the same frames with the "WPS" display filter in WiresharkI I dropped the issue since I had - in theory - disabled WPS on my AP's so considered it a smaller problem.

Please let me know the exact display filters to use to detect WPS pin attempts in some kind of a flood attack.

  • Could you see any wifi traffic from devices other than your own? I'm thinking that you're not going to see these packets in Wireshark. – schroeder Nov 14 '19 at 15:20
  • I am seeing the entire neighborhood's packets. I'm using Wireshark on a Macbook in monitor mode - monitoring channels 4 and 40 - which were my main Wifi channels. Unless the attacker sent the packets on an entirely different channel, and considering how long the attack went on, I should be able to see SOME packets despite my use of channel-hopping, between 4 and 40 like I mentioned. – Dev Kanchen Nov 14 '19 at 15:27
  • @schroeder that does not explain why I can't capture or see WPS packets in Wireshark along with all other 802.11 packets such as WPA2 auth/deauth Im already seeing. – Dev Kanchen Nov 14 '19 at 15:36
  • If the question is off-topic here, would you please recommend where I can post it. Network Engineering SE for questions of a similar nature before but they were quite strict about entertaining home-networking questionsons. I posted here because I thought I'd get a fast answer from security analysts about WPS, etc. – Dev Kanchen Nov 14 '19 at 16:11

Browse other questions tagged or ask your own question.