<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-wireless-denial-of-service
description: >-
  Detection and mitigation of wireless denial-of-service attacks including deauthentication floods, disassociation attacks, beacon flooding, authentication flooding, and RF interference identification.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wireless-dos
  - deauth-detection
  - beacon-flood
  - wids
  - rf-interference
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1498", "T1499", "T1557.002"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.PT-4"]
  uuid: 5d0c7ddf-bfc4-4d2f-86f8-6aed30fc6ea3
---

# Detecting Wireless Denial of Service

## Overview

Wireless denial-of-service attacks disrupt network availability through protocol abuse
or RF interference. Deauthentication floods, beacon flooding, CTS/RTS manipulation, and
authentication storms can render wireless networks unusable. This technique covers detection
using frame analysis, statistical anomaly detection, and spectrum monitoring to identify
and attribute DoS activity.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter in monitor mode (dedicated sensor) | Required |
| Kismet with alert configuration | Required |
| mdk4 knowledge for understanding attack patterns | Required |
| Spectrum analyzer for RF interference detection | Required |
| SIEM integration for alert correlation | Required |

## Key Concepts

### Wireless DoS Attack Patterns

```
Wireless DoS Detection Matrix:
├── Management Frame Attacks
│   ├── Deauthentication flood (type 0x0c)
│   ├── Disassociation flood (type 0x0a)
│   ├── Authentication flood (type 0x0b)
│   └── Beacon flood with spoofed SSIDs
├── Control Frame Attacks
│   ├── CTS flood (virtual carrier sense)
│   ├── RTS flood (NAV manipulation)
│   └── ACK spoofing
├── Data Frame Attacks
│   ├── EAPOL flood
│   ├── Encrypted frame replay
│   └── Oversized frame injection
└── Physical Layer
    ├── RF jamming (constant/reactive)
    ├── Channel saturation
    └── Interference source identification
```

### Deauthentication Flood Detection

```bash
# Real-time deauth frame counting
sudo tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c" \
  -T fields -e frame.time -e wlan.sa -e wlan.da -e wlan.bssid \
  -l 2>/dev/null | awk '{count++; if(count%10==0) print strftime("%T"), count, "deauth frames"}'

# Statistical analysis of management frames
sudo tshark -i wlan0mon -a duration:60 \
  -Y "wlan.fc.type == 0" \
  -T fields -e wlan.fc.type_subtype -e wlan.sa | \
  sort | uniq -c | sort -rn

# Detect targeted deauth (non-broadcast destination)
sudo tshark -i wlan0mon \
  -Y "wlan.fc.type_subtype == 0x0c && wlan.da != ff:ff:ff:ff:ff:ff" \
  -T fields -e wlan.sa -e wlan.da -e wlan.bssid
```

### Beacon Flood Detection

```bash
# Count unique SSIDs over time — beacon flood creates many
sudo timeout 30 airodump-ng wlan0mon --band abg -w flood_check --output-format csv 2>/dev/null
ssid_count=$(awk -F',' '/^[0-9A-F]/{print $14}' flood_check-01.csv | sort -u | wc -l)
echo "Unique SSIDs detected: $ssid_count"
# Normal environments: 10-50 SSIDs; beacon flood: 100s-1000s

# Analyze beacon intervals for anomalies
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.sa -e wlan.ssid -e wlan.fixed.beacon | \
  sort | uniq -c | sort -rn | head -20
```

### Kismet DoS Alert Configuration

```bash
# Configure Kismet for DoS detection
cat >> /etc/kismet/kismet_site.conf << EOF
# Deauth flood: >10/min from single source
alert=DEAUTHFLOOD,10/min,3/sec
# Disassociation flood detection
alert=DISASSOCTRAFFIC,10/min,3/sec
# BSS timestamp anomaly (AP impersonation)
alert=BSSTIMESTAMP,5/min,1/sec
# Beacon rate anomaly
alert=BEACONRATE,5/min,1/sec
# NULL probe response (reconnaissance indicator)
alert=NULLPROBERESP,10/min,2/sec
EOF

kismet -c wlan0mon --no-ncurses --log-types alert
```

## Workflow

### Step 1: Baseline Measurement

```bash
# Establish normal management frame rates
sudo tshark -i wlan0mon -a duration:300 -Y 'wlan.fc.type == 0' \
  -T fields -e wlan.fc.type_subtype | sort | uniq -c
```

### Step 2: Detection Rule Deployment

Configure Kismet alerts and custom tshark monitoring scripts.

### Step 3: Threshold Calibration

Tune detection thresholds based on baseline to minimize false positives.

### Step 4: RF Monitoring

Deploy spectrum analysis to detect physical-layer jamming attacks.

### Step 5: Response Procedures

Document automated and manual response procedures for wireless DoS events.

## Detection

```yaml
title: Wireless Denial Of Service Detection
id: 67288769-5ad7-4d1b-aa1a-3a986a3913f1
status: experimental
description: Detects suspicious activity related to detecting wireless denial of service techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1498
  - attack.t1499
  - attack.t1557.002
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Denial Of Service Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1498, T1499, T1557.002 |

## Verification

- [ ] Baseline management frame rates documented per environment
- [ ] Deauthentication flood detection validated with controlled test
- [ ] Beacon flood detection tested with mdk4 in isolated lab
- [ ] Kismet alert pipeline confirmed operational
- [ ] Response procedures reviewed and approved by security team

## References

- MITRE ATT&CK T1498 — Network Denial of Service
- MITRE ATT&CK T1499 — Endpoint Denial of Service
- IEEE 802.11w — Protected Management Frames
- [mdk4 documentation](https://github.com/aircrack-ng/mdk4)
