Installation guide

Chapter 10
150 Sniffer Technologies
Deauthentication
The Expert generates the Deauthentication alarm when it detects an 802.11
Deauthentication frame. Occasionally, wireless stations need to terminate
secure communications with one another or with an access point. To do so,
they send Deauthentication frames.
Deauthentication frames are a part of normal 802.11 network operations. A
relatively small number of these alarms is no cause for concern. However, a
large number of Deauthentication frames may indicate a potential
authentication denial attack on the wireless network.
The alarm display includes the following information:
 The destination address of the Deauthentication frame (that is, the
station with which the sending station want to terminate secure
communications).
 The Reason Code indicating the reason the Deauthentication frame
was sent. Possible values for the Reason Code field include:
 1 — Unspecified reason.
 2 — Previous authentication no longer valid.
 3 — Deauthenticated because sending station is leaving (or has
left) the network.
 6 — Class 2 frame received from non-authenticated station.
Disassociation
The Expert generates the Disassociation alarm when it detects an 802.11
Disassociation frame. Wireless stations and access points send
Disassociation frames to terminate associations with one another. For
example, an access point may terminate an association with a station because
it is unable to handle any more associations. Similarly, a wireless station may
terminate an association if it is leaving the network.
Disassociation frames are a part of normal 802.11 network operations. A
relatively small number of these alarms is no cause for concern. However, a
large number of Disassociation frames may indicate a potential denial of
service attack on the wireless network.
The alarm display includes the following information:
 The destination address of the Disassociation frame (that is, the station
with which the sending station want to terminate its association).
 The Reason Code indicating the reason the Disassociation frame was
sent. Possible values for the Reason Code field include: