Arduino IDE (the IDE stands for integrated development environment) allows you to quickly write and upload scripts to Arduino-like microcontroller devices.

This allows a low-cost ESP8266-based device programmed in Arduino to detect and classify Wi-Fi denial-of-service attacks by lighting a different color LED for each type of packet.

The pattern of these colors can also allow us to fingerprint the tool being used to attack the network.

Another type of jamming attempts to send messages that force the target to be disconnected from the network they are connected to, rather than drowning out a targets signal by trying to overwhelm it.

Because so-called management frames are not encrypted, it is possible to send disruptive messages from outside the network which causes people inside the network to be unable to connect.

Forging these packets is the key to hacking many Wi-Fi networks, as you can forcibly disconnect any client from the network at any time.

The ease of which this can be done is somewhat frightening and is often done as part of gathering a WPA handshake for cracking.

Dont Miss: Detect Wi-Fi Jamming Attacks with a NodeMCU Monitor Aside from momentarily using this disconnection to harvest a handshake to crack, you can also just let those deauths keep coming, which has the effect of peppering the client with deauth packets seemingly from the network they are connected to.

Because these frames arent encrypted, many programs take advantage of management frames by forging them and sending them to either one or all devices on a network.

The difference between deauthentication and disassociation frames is primarily that an AP looking to disconnect a rogue device would send a deauthentication packet to inform the device it has been disconnected from the network, whereas a disassociation packet is used to disconnect any nodes when the AP is powering down, rebooting, or leaving the area.

Weve covered both using and detecting both tools before, but in this example, well be setting a few design goals for detecting attacks against a network.

To do that, we need to understand the way each work to effectively jam a Wi-Fi network.

Aireplay-ng is often used to disconnect clients momentarily to obtain a Wi-Fi handshake, and it uses forged deauthentication packets to disconnect any networks or clients the user specifies either with a set number of deauthentication packets, or a continuous stream.

Its also used in frameworks like Airgeddon, which allow the results of scans to automatically be fed into Aireplay to actively attack any networks discovered in an area in real time.

MDK3 uses a blend of disassociation and deauthentication packets, initially having a slower onset than an Aireplay-ng attack.

This attack is also used in frameworks like Airgeddon, and it can be differentiated by the alternating pattern of deauthentication and disassociation packets it sends.

I found Spacehuhns DeauthDetector, which is a sketch in Arduino for ESP8266 devices like the NodeMCU that turns on an LED when a certain number of deauthentication or disassociation packets are detected.

Dont Miss: Use an ESP8266 Beacon Spammer to Track Smartphone Users Inside the DeauthDetector code, I found exactly what I needed to use an LED to show the type of attack underway, rather than just turning on a light when an attack is present.

Thats because the capture filter we used to find deauthentication and disassociation packets looks at the same elements, so we can split this code that looks for both into two different sections, one for managing a variable that tracks each kind of packet and turns on a corresponding LED to alert the user.

Youll also need a computer running Arduino IDE to program it, and either a three-color (RGB), four-pin LED or at least two LEDs to indicate when a packet of each type is detected.

Youll need a breadboard to wire this all together as well, and its recommended you use a resistor or potentiometer to avoid burning out your LED.

Heres a list of what I ended up using: ESP8266 NodeMCU CP2102 development board wireless module (less than 6 per unit) Solderless breadboard kit with jumper wires (around 11, but you can probably find a single breadboard with a few jumpers for less) Tricolor LED (around 9 for a bunch, but you can get just one at a local store for super cheap) Micro-USB cable (you probably already have one of these) Resistors (optional, if you want the LED to last longer).

Esp8266 Deauther Password