SonicOS 7 Access Points

Technical Documentation > SonicOS 7 Access Points > Advanced IDP > Viewing KRACK Sniffer Packets

Viewing KRACK Sniffer Packets

When the Enable Wireless Intrusion Detection and Prevention option is enabled, the SonicWave periodically scans the wireless environment looking for a KRACK Man-in-the-Middle access point and any clients interacting with it. KRACK is the acronym for Key Reinstallation Attack.

The KRACK MITM attack clones the real access point on a different channel with the same MAC address as the real access point. When a KRACK MITM access point is detected, the SonicWave opens a monitoring interface on the same channel as the KRACK MITM, and sniffs the packets on the channel for a period of time. If a wireless client is associated with the MITM access point and the Disassociate Client from KRACK MITM AP option is enabled, the client is disassociated from the MITM access point. Log messages are reported in the Monitor > Logs > System Logs page when any of the following events occur:

KRACK MITM access point is detected
Client is detected communicating with the MITM access point
Client is disassociated from the MITM access point

Because the sniffing is done during the KRACK detection process, the captured packets are saved in the buffer of the SonicWave. The below image shows the KRACK sniffer results from SonicWaves.

To analyze the KRACK process, click Downloadicon for a SonicWave to export the packet data to the file krackSniffer_[SonicWave name].cap, where [SonicWave name] is the name of the SonicWave. Then open the file and view it using Wireshark or another PCAP analyzer tool.

< Previous Section Next Section >

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

SonicOS 7 Access Points

Viewing KRACK Sniffer Packets

Was This Article Helpful?

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

Stay In Touch