3

I'm trying to create a bash script to detect deauthentication attacks (I am on Mac). Whilst I am aware that the command:

$ tcpdump -l -I -i en0 -e -s 256 type mgt subtype deauth

will detect deauthentication packets, I would also like to simultaneously detect disassociation packets. Normally, you would detect disassociation packets with:

$ tcpdump -l -I -i en0 -e -s 256 type mgt subtype disassoc

However, I was wondering if there was some way to manipulate this command to scan for both disassociation and deauthentication packets at the same time? E.g. the command:

$ tcpdump -l -I -i en0 -e -s 256 type mgt subtype deauth disassoc

will obviously not work but I hope that helps you get an idea of what I'm asking.

Furthermore, I completely understand that simply using the command:

$ tcpdump -l -I -i en0 -e -s 256 type mgt

will show me all management frames including both disassociation and deauthentication packets but will get clogged with other irrelevant frames like beacons, probe requests etc.

Indeed, I am aware that a simple grep implementation for example could remove pretty much all unwanted packets and leave just disassociation and deauthentication packets but I feel that this is a rather bodged way of doing it and would require more, inefficient, bash computational time to try and parse each line of every single management frame flying through the air.

Is there a simple way to modify the above tcpdump command to have it detect the two packet types I want? Or is it the case that I will have to look for a different sort of solution like with grep as I mentioned above?

P.S. I am on OSX rather than Linux.

3
  • The question has its merits, but too long. Could you shorten it up a bit? Aug 10, 2018 at 12:32
  • I have no way to test this, but try type mgt subtype disassoc or type mgt subtype deauth. You may need parens and a quoted string: '(type mgt subtype disassoc) or (type mgt subtype deauth)' Aug 10, 2018 at 12:45
  • @MarkPlotnick Thanks for your reply! I appreciate you trying to help me out but I've been told that using tcpdump -l -I -i en0 -e -s 256 'type mgt and (subtype deauth or subtype disassoc)' works perfectly for what I need.
    – Tom
    Aug 10, 2018 at 13:01

1 Answer 1

4

As described in the tcpdump manpage, you can combine filters wth keywords and , or, and not. You can use parentheses for grouping (note that to have your shell parse the command line correctly, you'll likely need quotes):

 tcpdump -l -I -i en0 -e -s 256 'type mgt and (subtype deauth or subtype disassoc)'
5
  • 1
    Perfect, this is exactly what I was looking for! Thank you so much
    – Tom
    Aug 10, 2018 at 13:00
  • Quick question: what difference would using and make as opposed to using or or not if any?
    – Tom
    Aug 10, 2018 at 13:02
  • I'm unsure of what you mean. 'A and B' means that both conditions A and B must be statisfied while 'A or B' means that it's sufficient that only either A or B is satisfied for the filter to match. Using one or the other depends on the filter you need.
    – lgeorget
    Aug 10, 2018 at 13:05
  • Ah, I see. I just wanted to clarify. I think that using or satisfies my use case as I am looking for both disassociation and deauthentication packets at the same time.
    – Tom
    Aug 10, 2018 at 13:08
  • Yes, that's the correct filter in your case. Note that a filter 'subtype deauth and subtype disassoc' would not work anyway since the same packet cannot simultaneously be of subtype deassoc and deauth. The filter expression is applied on each packet individually.
    – lgeorget
    Aug 10, 2018 at 13:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .