<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-wireless-jamming-attacks
description: >-
  Detection and characterization of wireless jamming attacks including constant jammers, deceptive jammers, reactive jammers, spectrum analysis techniques, and RF fingerprinting for jammer identification.
domain: cybersecurity
subdomain: wireless-security
tags:
  - rf-jamming
  - spectrum-analysis
  - wireless-dos
  - rf-fingerprinting
  - counter-jamming
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1498", "T1499", "T1200"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.PT-4"]
  uuid: 76886e36-cc6f-4e2a-b7cd-f3d7b78125f4
---

# Detecting Wireless Jamming Attacks

## Overview

Wireless jamming attacks deny service by overwhelming target frequencies with RF
energy. Detection requires spectrum analysis to distinguish intentional jamming from
legitimate interference. This covers constant, deceptive, reactive, and random jammer
identification using spectrum analyzers, signal quality metrics, and statistical
anomaly detection across Wi-Fi, cellular, and IoT frequency bands.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Software-defined radio for spectrum monitoring (RTL-SDR, HackRF) | Required |
| Spectrum analysis tools (rtl_power, inspectrum, GQRX) | Required |
| Wireless adapter for signal quality monitoring | Required |
| GPS receiver for location correlation | Required |
| Baseline RF measurements for monitored environment | Required |

## Key Concepts

### Jammer Classification

```
Wireless Jamming Detection:
├── Jammer Types
│   ├── Constant — continuous wideband noise
│   ├── Deceptive — valid-looking but malicious frames
│   ├── Reactive — transmits only when target active
│   ├── Random — intermittent interference patterns
│   └── Smart — targets specific protocols/channels
├── Detection Methods
│   ├── Spectrum analysis (energy detection)
│   ├── Signal-to-noise ratio monitoring
│   ├── Packet delivery ratio analysis
│   ├── Carrier sense failure rate tracking
│   └── RF fingerprinting for source identification
├── Characterization
│   ├── Affected frequency range
│   ├── Duty cycle measurement
│   ├── Power level estimation
│   ├── Directional analysis
│   └── Temporal pattern identification
└── Response
    ├── Channel switching (frequency hopping)
    ├── Power increase (if regulatory compliant)
    ├── Directional antenna deployment
    ├── Physical locate and report
    └── Law enforcement notification (FCC)
```

### Spectrum Monitoring

```bash
# Continuous spectrum monitoring with RTL-SDR
rtl_power -f 2400M:2500M:50k -g 40 -i 5 -e 24h wifi_spectrum.csv

# Real-time spectrum visualization
python3 -c "
import csv, sys, statistics
with open('wifi_spectrum.csv') as f:
    reader = csv.reader(f)
    for row in reader:
        powers = [float(x) for x in row[6:]]
        avg = statistics.mean(powers)
        peak = max(powers)
        if peak > -20:
            freq = float(row[2]) / 1e6
            print(f'[ALERT] High energy at {freq:.1f} MHz: peak={peak:.1f}dB avg={avg:.1f}dB')
"

# Monitor noise floor changes over time
while true; do
  noise=$(iw dev wlan0 survey dump 2>/dev/null | \
    awk '/noise/{print $NF}' | head -1)
  timestamp=$(date +%Y-%m-%dT%H:%M:%S)
  echo "$timestamp,$noise" >> /var/log/wireless/noise_floor.csv
  if [ "$noise" -gt -70 ] 2>/dev/null; then
    echo "[ALERT] Elevated noise floor: ${noise} dBm" | logger -t jamming
  fi
  sleep 10
done
```

### Signal Quality Degradation Detection

```bash
# Monitor packet delivery ratio per AP
while true; do
  iw dev wlan0 station dump | \
    awk '/Station/{mac=$2}
         /tx packets/{tx=$NF}
         /tx retries/{retries=$NF}
         /tx failed/{failed=$NF; if(tx>0) printf "%s retry_rate=%.1f%% fail_rate=%.1f%%\n",
           mac, retries/tx*100, failed/tx*100}'
  sleep 30
done

# Detect sudden carrier sense failures
iw dev wlan0 survey dump | \
  awk '/frequency/{freq=$2}
       /channel active/{active=$NF}
       /channel busy/{busy=$NF}
       /channel receive/{rx=$NF}
       /channel transmit/{tx=$NF} {
         if(active>0) {
           unknown = busy - rx - tx
           if(unknown/active > 0.5) printf "[JAMMING?] %s MHz: %.0f%% unexplained busy\n", freq, unknown/active*100
         }
       }'

# PDR analysis from pcap
tshark -r capture.pcap -q -z io,stat,1,"COUNT(frame)frame","COUNT(frame)wlan.fc.retry==1" | \
  tail -20
```

### RF Source Localization

```bash
# Signal strength triangulation with multiple sensors
for sensor in sensor1 sensor2 sensor3; do
  ssh $sensor "iw dev wlan0mon survey dump" | \
    awk -v s="$sensor" '/noise/{print s, $NF}'
done

# Direction finding with directional antenna
# Rotate antenna and log signal strength
for angle in $(seq 0 30 330); do
  echo -n "Angle $angle: "
  timeout 5 iw dev wlan0mon survey dump | awk '/noise/{print $NF}'
  echo "Rotate antenna to ${angle} degrees and press Enter"
  read
done
```

## Workflow

### Step 1: Baseline Measurement

```bash
# Establish normal noise floor and spectrum profile
rtl_power -f 2400M:2500M:50k -g 40 -i 10 -e 1h baseline.csv
```

### Step 2: Anomaly Detection

Deploy continuous spectrum monitoring with alerting for noise floor deviations.

### Step 3: Characterization

Identify jammer type, affected frequencies, duty cycle, and temporal pattern.

### Step 4: Localization

Use signal strength measurements from multiple sensors to estimate jammer location.

### Step 5: Response

Execute frequency hopping, notify authorities, and document incident.

## Detection

```yaml
title: Wireless Jamming Attacks Detection
id: babc4eff-bba7-4c19-8a35-4f4602a834a6
status: experimental
description: Detects suspicious activity related to detecting wireless jamming attacks techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1498
  - attack.t1499
  - attack.t1200
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Jamming Attacks Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1498, T1499, T1200 |

## Verification

- [ ] Spectrum baseline established for all monitored bands
- [ ] Noise floor monitoring automated with alerting
- [ ] Detection thresholds calibrated against legitimate interference
- [ ] Jammer characterization procedure documented and tested
- [ ] Response procedures include FCC notification process

## References

- MITRE ATT&CK T1498 — Network Denial of Service
- FCC Part 15 — Radio Frequency Devices (jamming regulations)
- IEEE 802.11 — Wireless LAN Medium Access Control
- [rtl-sdr documentation](https://osmocom.org/projects/rtl-sdr/wiki)
