Eric, I’ve never heard of a consumer device deauthing STAs that aren’t associated to themselves. If you happen to get a packet capture I know some people that would be interested in looking at it.
The only case of malicious deauths I’ve seen was from an enterprise vendor IPS. GT On 4/3/18, 9:42 AM, "The EDUCAUSE Wireless Issues Constituent Group Listserv on behalf of Kenny, Eric" <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU on behalf of eric_ke...@harvard.edu> wrote: >While investigating some “wifi is slow” and “wifi is dropping” complaints, we >noticed deauth/disassociation flooding attacks reported by our wireless IDS. >So far I’ve been able to identity a small percentage of these as local >businesses and other local (non-university affiliated) organizations. What >strikes me as odd is that a lot of the MAC OUIs from offending devices appear >to be consumer grade wireless devices (Belken, Netgear, eero, etc.). I’d love >to get a hold of one of these devices and look at its settings to see how it’s >configured. I’m not a lawyer, but I think this falls under regulation 47 U.S. >Code § 333. > >Besides filing a complaint with the FCC, I’m wondering if any of you have >experienced this on your campuses, and if so, how you’ve gone about dealing >with it. I’m afraid asking the business nicely would just result in a blank >stare, as they would not likely understand the nature of the complaint, or >what their wireless is actually doing. > >§333. Willful or malicious interference >No person shall willfully or maliciously interfere with or cause interference >to any radio communications of any station licensed or authorized by or under >this chapter or operated by the United States Government. >(June 19, 1934, ch. 652, title III, §333, as added Pub. L. 101–396, §9, Sept. >28, 1990, 104 Stat. 850.) > >Thanks, >----------------------------------- >Eric Kenny >Network Architect >Harvard University IT >----------------------------------- > > >********** >Participation and subscription information for this EDUCAUSE Constituent Group >discussion list can be found at http://www.educause.edu/discuss. > ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss.
