I am trying to understand a common "problem" when injection deauthentication frames in 802.11 networks.
My goal is to cause a client to re-authenticate (like one would do, to capture a 4-way-handshake) I do not want to cause a DoS.
Theoretically I would only need to send one fake deauth packet to do this. But when I send out a single deauth packet, nothing happens. Even with 10 or 20 packets I rarely get a re-authentication from the victim.
Aireplay-ng uses 64 packets with default settings, this number seems to work good for me as-well.
My main question now is:
Why does an attacker need to send so many fake frames, when a real AP only needs one frame to get the job done?
My test-setup is as follows:
- Acces Point:
- inksys wrt1200ac (openWRT)
- Channel 11, WPA2, "legacy" mode (no 802.11n)
- Android Smartphone
- Kali VM (running on a MacBook Pro(macOS catalina)
- ALFA AWUS036NHA
- No traffic or other devices on the test-network
The network is only used for my testing.
The general RF-space is probably as crowded as in a normal tech enthusiasts home: Bluetooth, ZigBee, 2.4 and 5 Ghz Home-WiFi + neighbors