This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

deauth from 00:00:00_00:00:00 to broadcast

0

What would be the point of a constant stream like this?

IEEE 802.11 Deauthentication, Flags: ........C
Type/Subtype: Deauthentication (0x0c)
Receiver address: Broadcast (ff:ff:ff:ff:ff:ff)
Destination address: Broadcast (ff:ff:ff:ff:ff:ff)
Transmitter address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Source address: 00:00:00_00:00:00 (00:00:00:00:00:00)
BSS Id: 00:00:00_00:00:00 (00:00:00:00:00:00)
IEEE 802.11 wireless LAN management frame
Reason code: Previous authentication no longer valid (0x0002)

asked 04 Nov '14, 12:45

redhern's gravatar image

redhern
11●1●1●2
accept rate: 0%

edited 04 Nov '14, 13:23

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237

One Answer:

0

What would be the point of a constant stream like this?

One possible reason, but not necessarily what's happening on your network!

Maybe someone is trying to crack your wifi keys. In order to capture the session init (required to crack keys) you need to de-authenticate the attached stations.

http://lewiscomputerhowto.blogspot.de/2014/06/how-to-hack-wpawpa2-wi-fi-with-kali.html

Regards
Kurt

answered 04 Nov '14, 13:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Where can I find this deauthentication packet? (Like under which field?) Thanks.

(30 Nov '14, 01:30) Prasad Falke

well, you posted one in your question !?!

(01 Dec '14, 16:55) Kurt Knochner ♦