Hands-On Penetration Testing with Kali NetHunter

Exercise – detecting a de-authentication attack

Earlier in this book, we looked at using an amazing tool called tcpdump to capture network traffic. Another great benefit of using this tool is to detect a de-authentication attack. As the attack is happening on the airwaves, we will be able to see it and determine its target.

To do this, we can use the tcpdump -n -e -s0 -vvv -i wlan0 | grep DeAuth command.

• -n specifics not to resolve the IP address
• -e indicates to print the MAC addresses of IEEE 802.11 and Ethernet traffic types
• -v indicates the level of verbosity
• -i specifies the interface

We will get the following output after running the preceding command:

The BSSID shown in the preceding screenshot indicates the victim access point. ...