WIRELESS / TIME-WINDOW REVIEW
Investigating Wi-Fi deauthentication observations
A burst of observed deauthentication frames needs a scoped investigation. The sensor counts deauthentication and disassociation observations in a configured window and raises an indicator when the threshold is reached. The count establishes observed frames, not confirmed disruption or attacker identity.
Keep capture scope and detector settings together
Use monitor-mode hardware on the channels under review and record the sensor, site, interval and configuration. Atheros Sensor groups valid BSSIDs separately. When a BSSID cannot be parsed, it uses a fallback source identity. Both deauthentication and disassociation frames count.
- A zero threshold or zero window disables this detector path.
- A cooldown can suppress repeated alerts even when frames continue to be observed. Alert totals are not raw frame totals.
- Missing frames, unmonitored channels and capture placement limit the interpretation of both positive and absent findings.
Reproduce the reasoning with a small synthetic window
For this teaching example, choose a threshold of 3 frames and a 10-second window. These are example settings, not production defaults or recommended thresholds. All four observations have BSSID 02:00:00:00:00:30 at lab-west on channel 6.
python3 - <<'PY'
times = [0, 1, 2, 3]
window_seconds = 10
threshold = 3
for index, now in enumerate(times):
count = sum(now - time < window_seconds for time in times[:index + 1])
print(now, count, count >= threshold)
PYThe four timestamps stay inside one window. The actual detector uses per-second buckets and a frame-time cooldown. This small example illustrates the threshold only.
0 1 False
1 2 False
2 3 True
3 4 TrueEach row shows elapsed seconds, observed count and whether the example threshold is reached. It is not sensor alert output.
| Time (UTC) | Frame subtype | Count at this observation | Interpretation |
|---|---|---|---|
| 10:00:00 | deauthentication | 1 | Below example threshold |
| 10:00:01 | disassociation | 2 | Also counted by this detector |
| 10:00:02 | deauthentication | 3 | Threshold reached. Eligible to alert |
| 10:00:03 | deauthentication | 4 | Still observed. Cooldown may suppress another alert |
Check the lead against nearby records
Review the source and receiver addresses, reason fields where decoded, BSSID, channel and timestamps in the original audit observations. Compare records before and after the burst, then check AP or client operational logs when available.
- Look for related association and authentication observations, but do not infer a complete session from a partial passive capture.
- Compare the interval with maintenance, AP restarts and client behavior. A frame subtype by itself does not reveal why the frame was transmitted.
- Inspect PMF-related context when available. A PMF indicator remains a separate heuristic and does not prove a client accepted or rejected the frame.
- Retain the configured threshold and cooldown with the investigation so a later analyst can explain why one alert represents several observations.
Report the observation and the unresolved impact separately
A defensible note can say that three matching frames were observed in the example window and that the configured condition was reached. It should state separately whether client impact was corroborated, which channels were monitored, and what identity remains unknown.
Observed: 3 deauthentication/disassociation frames in the example window
Scope: lab-west, sensor-lab-01, channel 6, BSSID 02:00:00:00:00:30
Detector condition: example threshold reached
Client impact: not established by passive observations
Transmitter identity: not confirmedThis records a lead without claiming a successful attack or a current connection.
Source code
The implementation behind the examples. Examples are educational inputs, not production records or measured results.
- Deauthentication counter and cooldown
Accepted subtypes, threshold comparison, grouping and cooldown behavior.
- Wireless audit model
Published observations retain sensor, site, time and decoded frame context.
- PMF review heuristics
PMF-related patterns are additional indicators, not proof of client behavior.