How to sniff De-Auth packet on 802.11x using Wireshark

If you’re interested to capture the traffic between two or more machine on Ethernet segment or in Management frame or in radio layer information you can’t capture it from your wlan0 interface.

What do you need is to enable your wireless as monitor mode. To do this you need airmon-ng from the aircrack suite.

airmon-ng start wlan0

To verify you are in mon0 :

iwconfig

You can see something like this :

mon0      IEEE 802.11abg  Mode:Monitor  Tx-Power=14 dBm   
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Power Management:on

What you have to do now just launch the Wireshark and capture mon0, you will see lot of beacon packet coming.

To filter de-auth packet use this :

wlan.fc.type_subtype eq 12

To filter Auth packet :

wlan.fc.type_subtype eq 11

 

 

 

This article was written by matn0t.