Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I Have a small net and last 2 weeks i get a lot of disconnections on my wireless stations a friend of mine told me that 90% i get attacked by deauth packets i i researched a bit and found this py script. But unfortunately i couldn't find any help on how to use it.. I m really new on linux is there anyone willing to help?


#!/usr/bin/env python

######################################################
#   authWatch.py v. 0.1 (Quick, Dirty and Loud) - by TinMan
#   Place card in monitor mode and set the channel. 
#   If you want channel hopping, run airodump-ng in 
#   another terminal. Will add channel hopping 
#   in the next version. 
######################################################  
#
#   Usage: python authWatch.py 
#   

import sys
from scapy import *

interface = sys.argv[1]

def sniffReq(p):
     if p.haslayer(Dot11Deauth):
# Look for a deauth packet and print the AP BSSID, Client BSSID and the reason for the deauth.
           print p.sprintf("Deauth Found from AP [%Dot11.addr2%] Client [%Dot11.addr1%], Reason [%Dot11Deauth.reason%]")
# Look for an association request packet and print the Station BSSID, Client BSSID, AP info.
     if p.haslayer(Dot11AssoReq):
           print p.sprintf("Association request from Station [%Dot11.addr1%], Client [%Dot11.addr2%], AP [%Dot11Elt.info%]")
# Look for an authentication packet and print the Client and AP BSSID
           if p.haslayer(Dot11Auth):
       print p.sprintf("Authentication Request from [%Dot11.addr1%] to AP [%Dot11.addr2%]")
       print p.sprintf("------------------------------------------------------------------------------------------")
sniff(iface=interface,prn=sniffReq)
share|improve this question
    
Note that unless your "friend" has an IT security or networking certification, it might not be "pings of death" or similar. In most cases getting disconnected from your wireless network access points might be unrelated to packets. It could be too many people using the network, if the wireless network is publicly usable by anyone and has no authentication requirements for use. –  Thomas W. Aug 31 '13 at 0:56
add comment

2 Answers

up vote 2 down vote accepted

The problem with your script was a indentation problem, that is common with python beginners:

python script.py 
  File "script.py", line 28
    print p.sprintf("Authentication Request from [%Dot11.addr1%] to AP [%Dot11.addr2%]")

                                                                                   ^
IndentationError: unindent does not match any outer indentation level

the space between ]") and ^ is filled with tabulation characters and that confuses the interpreter. Here is with the indentation corrected:

#!/usr/bin/env python

######################################################
#   authWatch.py v. 0.1 (Quick, Dirty and Loud) - by TinMan
#   Place card in monitor mode and set the channel. 
#   If you want channel hopping, run airodump-ng in 
#   another terminal. Will add channel hopping 
#   in the next version. 
######################################################  
#
#   Usage: python authWatch.py 
#   

import sys
from scapy import *

interface = sys.argv[1]

def sniffReq(p):
     if p.haslayer(Dot11Deauth):
# Look for a deauth packet and print the AP BSSID, Client BSSID and the reason for the deauth.
          print p.sprintf("Deauth Found from AP [%Dot11.addr2%] Client [%Dot11.addr1%], Reason [%Dot11Deauth.reason%]")
# Look for an association request packet and print the Station BSSID, Client BSSID, AP info.
     if p.haslayer(Dot11AssoReq):
          print p.sprintf("Association request from Station [%Dot11.addr1%], Client [%Dot11.addr2%], AP [%Dot11Elt.info%]")
# Look for an authentication packet and print the Client and AP BSSID
     if p.haslayer(Dot11Auth):
            print p.sprintf("Authentication Request from [%Dot11.addr1%] to AP [%Dot11.addr2%]")
            print p.sprintf("------------------------------------------------------------------------------------------")
sniff(iface=interface,prn=sniffReq)
share|improve this answer
    
i tryed the edited script now i get a different error root@x:~/Documents# python b.py Traceback (most recent call last): File "b.py", line 17, in <module> interface = sys.argv[1] IndexError: list index out of range –  HemaN Aug 31 '13 at 16:17
    
That's another error which you have to ask the script maker. –  Braiam Aug 31 '13 at 16:22
    
i l try:) is there any other script for detecting ping of deaths? –  HemaN Aug 31 '13 at 16:27
    
This is a backtrack forum that I found backtrack-linux.org/forums/showthread.php?t=35702 but I recommend you to use WPA2 and changing the password is the only way to defend yourself. –  Braiam Aug 31 '13 at 16:29
    
This looks very good but as a beginner cant understand all i stacked at root@x:~# airodump-ng --bssid CC:1A:FA:98:71:74 -w deauth.pcap --channel 13 didnt understand the rest how to fill out –  HemaN Aug 31 '13 at 16:53
show 1 more comment

It's stated as part of the script on how to execute it:

Usage: python authWatch.py

What you do is you need to open a terminal (Ctrl + Alt + T), navigate to wherever you saved the script, and then type python authWatch.py.

share|improve this answer
    
than u for ur fast reply i already try that and i get the following error root@x:~/Documents# python a.py File "a.py", line 27 if p.haslayer(Dot11Auth): ^ its a deaythenticatio script but i really dont know how to use it –  HemaN Aug 31 '13 at 12:21
    
forgot to say that my network is on monitor from who is on my wifi and only my macs are in it nobody else –  HemaN Aug 31 '13 at 13:54
    
That looks like it's not working because the software is missing dependencies or failing to run. But the question is so specific on a pasted script that's not in the repos, I don't think it's able to be answered any better. And because your network is only populated by your systems, and I assume you have a firewall protecting your network from external attack, it's unlikely "death packets" are the cause of your issues. I'd say it's more likely an issue of hardware or drivers, but I'm not qualified to make that determination from here. –  Thomas W. Aug 31 '13 at 14:53
    
My network runs on windows its a small netcafe so who is on my wifi i just runs ok i have ubuntu to my pc's works very good i get he mac of my phone when connected the thing is my problem started when a smal netcafe opened 20 meters from me and i have problem only to the wireless station and all start when he comes to shop.. –  HemaN Aug 31 '13 at 15:19
    
Two different wireless networks that aren't actually linked might be a signal interference problem. This problem is known at one of the Universities I attended, because they have an over-abundance of wireless access points and there are overlap points where the interference is deconstructive and you can't get a signal. I believe this might be your problem, that the signals are interfering with each other. Unfortunately, that's a bit hard to fix and can't be explained how to fix through a site here. –  Thomas W. Aug 31 '13 at 15:21
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.