WiFi deauth attack - Difference between Aireplay and MDK3

Question

I am currently working on some WiFi related security issues, and something appeared to me.

I have an Open WiFi network, to which a client connects.

I try the Deauth attack from Aireplay

aireplay-ng -0 0 -a 00:14:6C:7E:40:80 -c 00:0F:B5:34:30:30 mon0

However, this has no effect on the client nor the AP.

But, then I use MDK3 which is a software using the osdep library from the aircrack-ng project.

I do:

echo 00:14:6C:7E:40:80 > myfile

Then

mdk3 mon0 d -b myfile -c 11

And it works instantly! I tried to use wireshark to see what MDK3 is sending but there is too much WiFi pollution around and I don't know what I am looking for, I can't figure out what to do with it.

I would like to know if they are both sending Deauth frames, and if so, what is the difference between them ?

Do I misunderstand the attack run by MDK3 and therefore, could you please explain it to me ?

Answer 1

I was able to sort out the difference in the attack, I think.

I found out that to filter MAC addresses for 802.11 packets I had to use wlan.addr.

After it, I could see that MDK3 would be sending both disassociation and de-authentication packets, where aireplay only sent de-authentication packets.

Since I am using a particular type of wifi, I think this is the reason why aireplay wasn't able to break it. When using a reguler Open Wifi AP, both of them would break the network,

Cheers

Answer 2

The aireplay line doesn't actually send anything.

The "0" after the -0 represents the number of packets to send. You are telling it to send 0 deauth packets. Change that to at least 1, and it should work assuming the rest is correct.

Also, you generally don't use mon0 to send packets. That's the airmon-ng pseudo-interface. It may work on some systems, but use eth0 or whatever you wireless card is instead.

Answer 3

I often use aireplay-ng, and trying to use mdk3 will be different for advances users vs new users. Aireplay is a little bit hard to use, it has many options.

To perform a deauth attack, you must send many packets to target, 1-n packet, 10 ten packet, 100 packet or more.

But, for me mdk3 has better features, like a dynamic target (random), every target on the network will deauth depending on how many packets you send to network.

Aireplay of course, will work on closed network, no exception, it's WEP, WPA/2-TKIP, or WPA/2-AES.

Answer 4

your Command aireplay-ng -0 0 -a 00:14:6C:7E:40:80 -c 00:0F:B5:34:30:30 mon0

is commrect. the -0 set the tool to send de-auth frames. the 0 after -0 means sends non-stop de-auth frames untill canceled with control + c. so if you have set the correct access point mac with the -a option and the correct Station ( STA ) Mac address witht the -c option, i hope the stage is ready and it should of course work. Hey ! make sure that u have put the right mac addresses for this type of attack. You can double check your Mac address by running the airodump-ng tool, there you can notice the correct stations with the correct Access Points. Some stations MAC addresses will be present there but will be un-associated, on such stations the Attack may not work. I hope this is being infromative............Thanks

Answer 5

Are you sure you have used the correct BSSID(MAC)? and that you have selected the correct interface? skip to 2.00 minute mark here: aireplay-ng deauth and auth successfully https://www.youtube.com/watch?v=K0dJaBFmzAI