1

I'm fairly new to this. Some weeks ago I have started getting problems with my wireless connection. I thought that it could be caused by network traffic, so I decided to temporarily change the password of the router when I wanted to use it for myself. At the beginning it worked, and I was getting a normal speed (10-13 mbps by some speed tests) consistently. But then after a few days it stopped working again. I thought that someone could be trying to mess with my connection (or maybe isp or channel overlap?) and I tried changing the channels but the connection always got worse the higher the channel got. So I changed the SSID of the network. It worked, and the connection started going well immediately, but only for that day then it got worse again. I toyed with my router options a bit and set the network to hidden. Same thing, got better but only for some time.

I tried to see if I could catch some info on wireshark but I didnt see anything weird. I explored a bit of the internet and saw some info about jamming attacks. I got interested, and ended up downloading a kali image for virtualbox and aircrack-ng (wich where a bit of a pain to set up with my wireless adapter).

So I got the machine working and tried to capture some packets, setting the adapter in monitor mode and executing airodump-ng. Yesterday I didnt see anything rare, just the already known APs from my area and some clients, and my internet was fine. But today my connection halted to a crawl again, changing the password didnt seem to have an effect, and I was getting 1/3 or less of my usual speed (and im the only one connected). I booted up kali and ran airodump and saw a client that had a lot of traffic, with many packages but that wasnt connected to any AP, and in the Probes field had a lot of network names (just for that client) wich were variations of the name of my network, things like the full name of my network but with one letter different, or with a number added (names that I never used) and besides that a lot of additional network names. I have the feeling that this names were written by someone manually because one of the variations was changing one instance of the letter 'l' in the original name of my network to a non english character 'ñ'. His mac address didn't tell anything, it was only a 2 and a row of 0s.

¿Anyone knows what this client is doing and what could I do in this situation?

Also thanks for reading the long post.

2
  • They are most certainly trying to get back on your network. They will know it's the same router no matter what you change the SSID to, because it broadcasts the Mac address of the radio in the bssid. (Management frames) What you are seeing is them trying to guess the network name, but having to add it manually, and not removing the attempted guesses from the network manager of the o.s. So it will continue probing all the name attempts left in the manager. Aug 25, 2020 at 23:51
  • Choose a super complicated password. 16 Digits with uppercase lowercase and special characters. The more random the better, make sure WPS is turned off in the router. Disable remote management if you also have the option. Aug 25, 2020 at 23:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.