I am currently working on some WiFi related security issues, and something appeared to me.

I have an Open WiFi network, to which a client connects.

I try the Deauth attack from Aireplay

aireplay-ng -0 0 -a 00:14:6C:7E:40:80 -c 00:0F:B5:34:30:30 mon0

However, this has no effect on the client nor the AP.

But, then I use MDK3 which is a software using the osdep library from the aircrack-ng project.

I do:

echo 00:14:6C:7E:40:80 > myfile


mdk3 mon0 d -b myfile -c 11

And it works instantly! I tried to use wireshark to see what MDK3 is sending but there is too much WiFi pollution around and I don't know what I am looking for, I can't figure out what to do with it.

I would like to know if they are both sending Deauth frames, and if so, what is the difference between them ?

Do I misunderstand the attack run by MDK3 and therefore, could you please explain it to me ?

5 Answers 5


I was able to sort out the difference in the attack, I think.

I found out that to filter MAC addresses for 802.11 packets I had to use wlan.addr.

After it, I could see that MDK3 would be sending both disassociation and de-authentication packets, where aireplay only sent de-authentication packets.

Since I am using a particular type of wifi, I think this is the reason why aireplay wasn't able to break it. When using a reguler Open Wifi AP, both of them would break the network,



The aireplay line doesn't actually send anything.

The "0" after the -0 represents the number of packets to send. You are telling it to send 0 deauth packets. Change that to at least 1, and it should work assuming the rest is correct.

Also, you generally don't use mon0 to send packets. That's the airmon-ng pseudo-interface. It may work on some systems, but use eth0 or whatever you wireless card is instead.

  • 3
    the 0 after -0 means send packets continuously. aircrack-ng.org/doku.php?id=deauthentication So yes it actually sends packets ;) And the attack works using mon0, tried it on a different WiFi.
    – Shitrozore
    Jun 20, 2014 at 6:08
  • From the documentation: "0 means send them continuously"
    – ChrisG
    Sep 16, 2014 at 14:38

I often use aireplay-ng, and trying to use mdk3 will be different for advances users vs new users. Aireplay is a little bit hard to use, it has many options.

To perform a deauth attack, you must send many packets to target, 1-n packet, 10 ten packet, 100 packet or more.

But, for me mdk3 has better features, like a dynamic target (random), every target on the network will deauth depending on how many packets you send to network.

Aireplay of course, will work on closed network, no exception, it's WEP, WPA/2-TKIP, or WPA/2-AES.

  • I'm not sure that this answers the question. The OP is looking for specific help, not an overview of the 2 programs.
    – schroeder
    Jun 19, 2014 at 20:08

your Command aireplay-ng -0 0 -a 00:14:6C:7E:40:80 -c 00:0F:B5:34:30:30 mon0

is commrect. the -0 set the tool to send de-auth frames. the 0 after -0 means sends non-stop de-auth frames untill canceled with control + c. so if you have set the correct access point mac with the -a option and the correct Station ( STA ) Mac address witht the -c option, i hope the stage is ready and it should of course work. Hey ! make sure that u have put the right mac addresses for this type of attack. You can double check your Mac address by running the airodump-ng tool, there you can notice the correct stations with the correct Access Points. Some stations MAC addresses will be present there but will be un-associated, on such stations the Attack may not work. I hope this is being infromative............Thanks


Are you sure you have used the correct BSSID(MAC)? and that you have selected the correct interface? skip to 2.00 minute mark here: aireplay-ng deauth and auth successfully https://www.youtube.com/watch?v=K0dJaBFmzAI


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .