Kismet Wireless

Kismet Forums

 

Posted by:mxc
Subject:IDS Not Detecting Deauth Attack from aireplay-ng?
Date:10:44:56 11/03/2016

Hi all,

I have installed kismet on Ubuntu 15.10. The server and client start up fine and the gui displays the detected APs and client etc.

The alert log also show alerts relating to BSS which might be spoofed so it the logging appears to be configured correctly. In the /etc/kismet/kismet.conf file the alert setting for deauth flood is set.

alert=DEAUTHFLOOD,5/min,2/sec
alert=DEAUTHCODEINVALID,5/min,1/sec


When I run "aireplay-ng -0 10 -a <bssid> -c <client mac> wlan0" the client is deauthed but kismet does not detect the attack. I have tried "10","30","50" for the number of attempts to deauth the client and kismet does not raise any alert.

What can I do to get kismet to detect aircrack deauth attakcs?

thanks


Reply to this message