Case study – identifying the attacker

In this example, we have received two capture files for analysis. We start investigating the first file as follows:

We can see that the Link type is 802.11, which means that we are investigating a WLAN. Let's see the endpoints on this network:

From the preceding statistics, we can see that we have plenty of deauthenticated packets that have been directed to the broadcast address. We can also see that two stations, 54:99:63:82:64:f5 and 2c:33:61:77:23:efwere both involved in deauthentication, which means ...

Get Hands-On Network Forensics now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.