In this example, we have received two capture files for analysis. We start investigating the first file as follows:
We can see that the Link type is 802.11, which means that we are investigating a WLAN. Let's see the endpoints on this network:
From the preceding statistics, we can see that we have plenty of deauthenticated packets that have been directed to the broadcast address. We can also see that two stations, 54:99:63:82:64:f5 and 2c:33:61:77:23:ef, were both involved in deauthentication, which means that they might have received the deauthentication packets as well. Let's check this in Wireshark, as shown in the following screenshot:
We can see that the first deauthentication packet was broadcast at frame 4,175. Most of the time, the deauthentication packet will contain the reason code: the Class 3...
