4-15
According to the logs of the AP, the AP did not send and Deauth packet. Therefore, the illegal Deauth packets were not sent
by this AP.
According to the preceding analysis, a rogue AP may send illegal Deauth packets to the normally associated users, as shown
in Figure 2. By comparing the signal strength of the packets transmitted by the AP (as shown in Figure 3), it is found that the
signal strength of the normal packets is about 26% and the signal strength of the Deauth packets is 100%. It was confirmed
that certain rogue AP transmit Deauth packets to the clients of China Unicom users. According to the signal strength, the rogue
AP was close to the test point. As a result, users in the AP coverage area frequently got offline and could not use the WLAN
services.
Figure 1 Excessive Deauth packets
Figure 2 Rogue AP sending MAC Deauth packets
Figure 3 Comparison of signal strength of normal packets and Deauth packets
[Information collection]
The rogue AP can be located as follows:
