Deauth detection

Deauth frames knock devices off Wi-Fi. This scan logs every deauth frame it hears and flags a flood.

How it works

A deauthentication frame tells a device to disconnect from its access point. A few are normal. A burst of them aimed at one device, or at everyone on a network, is an attack. The node logs each deauth frame and raises an alert when it sees a burst.

The node flags a burst of 12 deauths between one source and one device within 1 second. It flags a DEAUTH_FLOOD when one source sends 20 deauths within 10 seconds and they arrive fast enough to look automated (a mean gap of 150 ms or less). A broadcast deauth alerts when it is part of such a burst. An attacker can fake the source address, so treat the source as a hint, not proof.

Start

• Web UI: Scan tab → Deauth Detection → Start Scan.
• Over mesh: @ALL DEAUTH_START:300 listens for 300 seconds.

Deauth detection and Sentinel

Sentinel runs deauth detection in the background along with its other detectors, and names the tool behind a deauth frame when it recognizes one. Run this scan on its own when you want to watch only for deauths, or when Sentinel is off.

If it never alerts

Deauth frames are sent on the attacked network's channel. Make sure the node is watching that channel. A single deauth is not flagged; the alert needs a burst.