13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
Key Takeaways
- 802.11 management and control frames were unencrypted and unauthenticated in WEP, WPA, and WPA2, which is why deauthentication attacks work; 802.11w Protected Management Frames is the countermeasure and is mandatory in WPA3.
- A rogue access point is an unauthorized AP attached to the organization's wired network, while an evil twin is an attacker AP that clones a legitimate SSID and BSSID without touching the wired network — the detection method differs accordingly.
- Capturing WPA2 traffic for decryption requires recording the complete four-way handshake, which is why an examiner deauthenticates a client to force reassociation only when explicitly authorized.
- MAC spoofing is exposed by inconsistencies the attacker cannot clone: sequence-number discontinuities in 802.11 frames, differing signal strength and per-frame RSSI from a different physical location, and duplicated addresses appearing on two APs at once.
- RF jamming leaves no frames to capture, so the evidence is spectrum-analyzer data plus a controller-side pattern of simultaneous client loss across every SSID on one channel with normal operation on other channels.
13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
Quick Answer: Blueprint Domain 5 requires understanding wireless network security vulnerabilities, performing attack and vulnerability monitoring, detecting a rogue access point and access point MAC spoofing attempts, detecting misconfigured access points, honeypot access points, and signal jamming attacks, and investigating wireless network traffic. The structural weakness underlying most of these is that 802.11 management and control frames are sent in cleartext and unauthenticated under WEP, WPA, and WPA2. That single fact enables deauthentication, evil twins, and MAC spoofing. 802.11w Protected Management Frames — mandatory in WPA3 — is the fix.
802.11 Frame Types: What Capture Actually Yields
| Frame type | Subtypes of forensic interest | Encrypted? |
|---|---|---|
| Management (type 0) | Beacon, Probe Request/Response, Authentication, Association Request/Response, Deauthentication, Disassociation | No (until 802.11w) |
| Control (type 1) | RTS, CTS, ACK, Block ACK, PS-Poll | No |
| Data (type 2) | Data, QoS Data, Null (power-save signaling) | Payload encrypted under WEP/TKIP/CCMP/GCMP |
Forensic consequence: even on a fully encrypted WPA2 network, an examiner with a monitor-mode capture obtains, without any key: every SSID, every BSSID, every client MAC address, association and disassociation timing, signal strength per frame, and the probe request list from each client — a record of every network that device has previously joined, which is a powerful device-movement and geolocation artifact.
Capture Requirements
Wireless capture requires an adapter in monitor mode (not promiscuous mode, which only lifts the MAC filter on a wired NIC), locked to a specific channel or hopping across channels.
| Tool | Role |
|---|---|
| airodump-ng (Aircrack-ng suite) | Channel hopping discovery, BSSID/ESSID/client enumeration, handshake capture to .cap |
| Kismet | Passive multi-radio detection, rogue/hidden SSID discovery, long-term logging with GPS |
| Wireshark / tshark | Frame-level dissection with the wlan and radiotap dissectors |
| Spectrum analyzer (e.g. Wi-Spy, Ekahau) | Layer-1 RF energy — the only way to see jamming |
| WIDS/WIPS (Cisco, Aruba, Meraki) | Continuous infrastructure-side rogue and anomaly detection |
The radiotap header prepended by the capture driver carries RSSI, channel, and data rate per frame — the signal-strength values that make physical-location analysis possible.
Wireless Security Protocol Weaknesses
| Protocol | Cipher | Core weakness |
|---|---|---|
| WEP | RC4, 24-bit IV | The IV space is only ~16.7 million values, so IVs repeat; statistical attacks recover the key from enough captured frames in minutes. Broken beyond any use. |
| WPA (TKIP) | RC4 + per-packet key mixing | Interim retrofit for WEP hardware; Michael MIC is weak, vulnerable to Beck-Tews style attacks. Deprecated. |
| WPA2-PSK | AES-CCMP | Cipher is sound; the four-way handshake is capturable and the PSK is then attacked offline with a dictionary or mask. KRACK (2017) attacked handshake key reinstallation. |
| WPA2-Enterprise | AES-CCMP + 802.1X/EAP | Strong, but misconfigured supplicants that do not validate the RADIUS server certificate fall to evil-twin credential theft. |
| WPA3-SAE | AES + SAE (Dragonfly) | Resists offline dictionary attack; forward secrecy; 802.11w PMF mandatory, which blocks deauthentication. Transition mode re-exposes WPA2 weaknesses. |
Why the four-way handshake matters to an examiner: decrypting captured WPA2 data traffic requires the PSK and a capture containing the complete four-way handshake for that client session. A capture started after a client associated cannot be decrypted for that session.
[!WARNING] Forcing a reassociation by transmitting deauthentication frames is an active, disruptive technique that denies service to a live client and can constitute unauthorized interference. Perform it only under explicit written authorization and document it in the case notes; a passive capture that waits for natural reassociation is the default.
Rogue Access Points vs. Evil Twins
These are constantly confused, and the distinction drives the entire detection method.
| Rogue AP | Evil Twin | |
|---|---|---|
| Definition | An unauthorized AP physically connected to the organization's wired network | An attacker-operated AP impersonating a legitimate SSID (and often BSSID), not connected to the corporate wire |
| Threat | Bypasses perimeter controls; creates an unmonitored path into the LAN | Harvests credentials and performs man-in-the-middle on clients that associate |
| Wireless detection | Unknown BSSID broadcasting a corporate or any SSID in the facility | Duplicate SSID with a different BSSID, or the same BSSID with a different RSSI pattern and different channel |
| Wired detection | This is the key test — trace the AP's MAC to a switch port via the CAM table, or correlate wireless BSSID to a wired MAC in the same OUI range | Not present on the wired network at all |
| Corroboration | %PORT_SECURITY-2-PSECURE_VIOLATION, an unexpected MAC OUI on an access port, or an unauthorized DHCP server appearing | Clients reporting certificate warnings; a captive portal that does not match the corporate one |
An AP honeypot is the evil twin's promiscuous cousin: it responds to any probe request with a matching probe response, so a client searching for Home_WiFi, Airport_Free, and CorpNet receives an affirmative answer to all three and associates. The capture signature is unmistakable — one BSSID answering probe requests for many unrelated SSIDs.
Misconfigured access points round out the blueprint's list: an AP left on WEP or open authentication, broadcasting a default SSID and default administrative credentials, with WPS PIN enabled (brute-forceable), or bridging the guest VLAN into the corporate VLAN. These are found by configuration audit and by comparing every AP's advertised capabilities in beacon frames against the approved baseline.
Access Point and Client MAC Spoofing
A MAC address is a 6-byte field an attacker sets at will (ifconfig wlan0 hw ether, macchanger). Spoofing defeats MAC allow-listing and lets an evil twin present a legitimate BSSID. Detection relies on the properties the attacker cannot clone:
- Sequence-number analysis. Every 802.11 frame carries a 12-bit sequence number that increments monotonically per transmitter. Two devices using one MAC produce interleaved, discontinuous sequence streams — jumps backward and forward that a single radio never generates. This is the single most reliable spoofing indicator.
- Signal strength (RSSI) fingerprinting. A stationary AP delivers a stable RSSI to a given sensor. A spoofed frame arriving from a different physical location shows a markedly different RSSI, and plotting RSSI over time reveals two distinct clusters for one MAC.
- Simultaneous appearance. The same MAC associated to two APs on opposite sides of a building at the same instant is physically impossible for one device.
- Capability and fingerprint mismatch. Beacon intervals, supported-rate sets, information-element ordering, and vendor-specific IEs differ between hardware. A cloned BSSID whose beacon IEs do not match the genuine AP's is a forgery.
- Timing/clock skew. The 802.11 timestamp field in beacons reveals per-radio clock drift; two different radios claiming one BSSID show inconsistent drift curves.
Deauthentication and Disassociation Attacks
Because management frames are unauthenticated below 802.11w, anyone can transmit a deauthentication frame spoofing the AP's BSSID, and clients obey it.
Purposes: force reassociation to capture the four-way handshake; push clients onto an evil twin; deny service.
Capture signature:
- A high volume of type 0 / subtype 12 (deauthentication) or subtype 10 (disassociation) frames.
- Common reason codes: 7 (class 3 frame received from nonassociated STA) and 1 (unspecified).
- Broadcast destination
ff:ff:ff:ff:ff:fftargets every client at once; a unicast destination targets one victim, which is stealthier and more indicative of a targeted evil-twin push. - The temporal pattern that makes the case: deauthentication burst → client disassociation → reassociation to a different BSSID advertising the same SSID.
WIDS/WIPS consoles log this as a "deauthentication flood" or "management frame anomaly." 802.11w PMF cryptographically protects deauthentication and disassociation frames, so a WPA3 network simply ignores the forged frames.
Signal Jamming: The Attack With No Frames
RF jamming floods the channel with noise or continuous energy so that carrier sense never clears. It operates at Layer 1, so there is nothing to capture with a protocol analyzer — a packet capture of a jammed channel is simply empty.
Evidence sources:
| Source | Indicator |
|---|---|
| Spectrum analyzer | Continuous elevated noise floor across the channel with no valid 802.11 frame structure |
| Controller/AP telemetry | Channel utilization near 100% with near-zero successful frame throughput; a collapsed signal-to-noise ratio |
| Client behavior | Every client on one channel loses connectivity simultaneously while clients on other channels operate normally |
| Retry counters | Retransmission rate spiking toward 100% immediately before total loss |
The distinguishing test: a deauthentication attack produces a flood of frames; a jamming attack produces an absence of frames with a raised noise floor. Both cause clients to drop, and the exam expects you to separate them by that signature. A jamming event confined to one channel while adjacent channels are healthy also rules out a general hardware or power failure.
Investigating Wireless Traffic: A Working Sequence
- Preserve infrastructure telemetry first — WLC/WIDS logs, RADIUS accounting, and AP association tables, all of which age out.
- Enumerate the RF environment with a channel-hopping passive capture (
airodump-ng, Kismet) and record GPS or floor position for each sensor. - Baseline the authorized estate — every approved BSSID, channel, and security configuration — so anything outside it is by definition suspect.
- Triage anomalies: duplicate SSIDs on unexpected BSSIDs, unknown BSSIDs, deauthentication bursts, one BSSID answering many SSID probes.
- Test the wired side for rogue APs: search switch CAM tables for the AP's MAC or OUI and check port-security violations.
- Analyze sequence numbers and RSSI on any MAC appearing suspicious to confirm or exclude spoofing.
- Correlate to client evidence — endpoint wireless profile history, Windows
netsh wlan show profilesand the WLAN-AutoConfig operational log, macOScom.apple.wifipreference plists and known-network lists — to prove which device associated to the hostile AP and when.
An examiner reviewing a monitor-mode capture finds frames claiming BSSID 00:1A:2B:3C:4D:5E with 802.11 sequence numbers that repeatedly jump backward and forward, and RSSI values that cluster into two distinct bands roughly 30 dBm apart. What does this establish?
At 14:02 every wireless client on channel 6 in one building loses connectivity for eleven minutes while clients on channels 1 and 11 in the same building remain fully connected. A packet capture on channel 6 for that window contains no 802.11 frames at all. What occurred?
An organization runs WPA2-Enterprise. An examiner is asked why an attacker was able to knock a specific executive's laptop off the network repeatedly and capture its four-way handshake, and what configuration change prevents a recurrence.