Study guide
13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
Computer Hacking Forensic Investigator CHFI 312-49
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility 1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness 1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence 1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
2 Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL) 2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals 2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics 2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
3 Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards 3.2 Fourth Amendment, Warrant Exceptions, Workplace Search & Consent Protocols 3.3 International Standards: ISO/IEC 27037, ACPO Principles & ENFSI Guidelines 3.4 Cybercrime Statutes, Privacy Compliance, CAN-SPAM & International Cooperation
4 Chapter 4: eDiscovery, Chain of Custody & Professional Ethics
4.1 Electronic Discovery Reference Model (EDRM) & Legal Spoliation Holds 4.2 Chain of Custody Documentation, Evidence Packaging & Tamper-Evident Handling 4.3 Expert Witness Testimony, Report Writing Standards & EC-Council Code of Ethics
5 Chapter 5: Storage Architecture, Boot Sequences & Media Forensics
5.1 Storage Media Architecture: Sectors, Clusters, RAM/File Slack & Unallocated Space 5.2 Partition Tables & Boot Structures: MBR, GPT, VBR, BIOS vs. UEFI Secure Boot 5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)
6 Chapter 6: Windows File Systems: NTFS & FAT
6.1 NTFS Architecture: Master File Table ($MFT) Record Structure & Attribute Headers 6.2 NTFS Artifacts: Alternate Data Streams (ADS), Volume Shadow Copies (VSS) & $LogFile 6.3 FAT12/16/32 and exFAT Architecture, Directory Entries & File Deletion Mechanics
7 Chapter 7: Non-Windows File Systems & File Signatures
7.1 Linux File Systems: ext2/ext3/ext4 Inode Architecture, Superblocks & Journaling Forensics 7.2 macOS File Systems: HFS+ and Apple File System (APFS) Architecture & Snapshots 7.3 File Signatures, Magic Bytes, Hex Headers/Footers & File Carving Techniques
8 Chapter 8: Investigation Lifecycle, Lab Setup & First Response
8.1 Forensic Laboratory Accreditation: ISO/IEC 17025 Standards & Hardware/Software Controls 8.2 First Responder Duties: Crime Scene Containment, Electronic Triage & Volatile Triage 8.3 Physical Evidence Packaging, Anti-Static/Faraday Protection & Transport Security
9 Chapter 9: Forensic Acquisition & Verification Methodology
9.1 Hardware and Software Write-Blockers: Operational Validation & Bridge Verification 9.2 Bit-Stream Disk Imaging, Physical vs. Logical vs. Targeted Acquisition Methodology 9.3 Forensic Image Formats (RAW/DD, E01, AFF) & Cryptographic Hashing Verification (MD5, SHA-256)
10 Chapter 10: Anti-Forensics Techniques & Countermeasures
10.1 Steganography Detection: Spatial/Frequency Domain Steganalysis & Hidden Carrier Extraction 10.2 Timestomping Countermeasures: Comparing $STANDARD_INFORMATION vs $FILE_NAME Timestamps 10.3 Secure Wiping, Degaussing, File Shredding Countermeasures & Residual Artifact Recovery
11 Chapter 11: Windows Operating System Forensics
11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis 11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist 11.3 User Activity Artifacts: ShellBags, LNK Shortcut Files, Jump Lists & Recycle Bin ($I/$R) 11.4 Windows Event Log Forensics: Security Audit IDs (4624, 4625, 4688, 4720, 7045) & EVTX Parsing
12 Chapter 12: Memory Forensics & Malware Analysis
12.1 Volatile Memory Acquisition: RAM Capture, Crash Dumps, Hiberfil.sys & Pagefile.sys 12.2 Memory Analysis with Volatility 3: pslist, pstree, malfind, netscan & Vadinfo 12.3 Static Malware Triage: Strings, PE Headers, Import Tables, Hashes & YARA Rule Matching 12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts 12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
13 Chapter 13: Network, Web Application & Email Forensics
13.1 Network Forensics: PCAP Analysis, Protocol Dissection, Snort/Suricata & Flow Analysis 13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection 13.3 Email Forensics: RFC 5322 Headers, Authentication (SPF, DKIM, DMARC) & Mbox/PST Extraction 13.4 SIEM Event Correlation, Cross-Source Timeline Analysis & Super-Timeline Construction 13.5 Investigating Directory Traversal, Command Injection, Parameter Tampering, XXE, Cookie Poisoning & Brute Force 13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH 13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
14 Chapter 14: Mobile, Cloud & IoT Forensics
14.1 Mobile Device Forensics: Manual, Logical, File System & Physical Extraction (Android/iOS) 14.2 Mobile Artifact Analysis: Call Logs, SMS/Chat SQLite Databases, Location Data & Plists 14.3 Cloud Forensics: AWS CloudTrail, Azure Activity Logs & Multi-Tenant Evidence Collection 14.4 IoT Forensics: UART/JTAG Physical Interfaces, Firmware Extraction & Sensor Telemetry
15 Chapter 15: Commercial & Open-Source Forensic Suites
15.1 Commercial Forensic Platforms: EnCase Forensic, FTK (Forensic Toolkit) & FTK Imager 15.2 Open-Source Forensic Platforms: Autopsy, The Sleuth Kit (TSK) & SIFT/CAINE Workstations 15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite
16 Chapter 16: Analysis Toolkits, Python Scripting & Tool Validation
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper 16.2 Python for Digital Forensics: Parsing Raw Artifacts, Custom Scapy Scripts & Evidence Automation 16.3 Forensic Tool Testing & Validation: NIST CFTT Methodology, ISO/IEC 17025 Standards & Daubert Compliance
17 Chapter 17: Database Forensics & Web Application Firewalls
17.1 MySQL Forensics: Internal Architecture, Data Directory, Information Schema & Utility Programs 17.2 SQL Server Forensics: SSMS, ApexSQL, SQLCMD Transaction-Log Collection, Plan Cache & Trace Files 17.3 Web Application Firewall (WAF) Architecture, Audit Logs, Benefits & Limitations
18 Chapter 18: Social, Virtualized, Multimedia & Browser Investigations
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics 18.2 Virtualization, Container & Microservices Forensics, Bluetooth and Electron Chat Applications 18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection 18.4 Browser Artifact Recovery, Private Browsing, USB Enumeration, Partition Recovery & Packer Unpacking Tools
13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
Key Takeaways Explain This Topic AI
802.11 management and control frames were unencrypted and unauthenticated in WEP, WPA, and WPA2, which is why deauthentication attacks work; 802.11w Protected Management Frames is the countermeasure and is mandatory in WPA3.
A rogue access point is an unauthorized AP attached to the organization's wired network, while an evil twin is an attacker AP that clones a legitimate SSID and BSSID without touching the wired network — the detection method differs accordingly.
Capturing WPA2 traffic for decryption requires recording the complete four-way handshake, which is why an examiner deauthenticates a client to force reassociation only when explicitly authorized.
MAC spoofing is exposed by inconsistencies the attacker cannot clone: sequence-number discontinuities in 802.11 frames, differing signal strength and per-frame RSSI from a different physical location, and duplicated addresses appearing on two APs at once.
RF jamming leaves no frames to capture, so the evidence is spectrum-analyzer data plus a controller-side pattern of simultaneous client loss across every SSID on one channel with normal operation on other channels.
Last updated: September 2026
13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
Quick Answer: Blueprint Domain 5 requires understanding wireless network security vulnerabilities , performing attack and vulnerability monitoring , detecting a rogue access point and access point MAC spoofing attempts , detecting misconfigured access points, honeypot access points, and signal jamming attacks , and investigating wireless network traffic . The structural weakness underlying most of these is that 802.11 management and control frames are sent in cleartext and unauthenticated under WEP, WPA, and WPA2. That single fact enables deauthentication, evil twins, and MAC spoofing. 802.11w Protected Management Frames — mandatory in WPA3 — is the fix.
802.11 Frame Types: What Capture Actually Yields
Frame type Subtypes of forensic interest Encrypted?
Management (type 0) Beacon, Probe Request/Response, Authentication, Association Request/Response, Deauthentication , Disassociation No (until 802.11w)
- Control (type 1) RTS, CTS, ACK, Block ACK, PS-Poll No
- Data (type 2) Data, QoS Data, Null (power-save signaling) Payload encrypted under WEP/TKIP/CCMP/GCMP
Forensic consequence: even on a fully encrypted WPA2 network, an examiner with a monitor-mode capture obtains, without any key: every SSID, every BSSID, every client MAC address , association and disassociation timing, signal strength per frame, and the probe request list from each client — a record of every network that device has previously joined, which is a powerful device-movement and geolocation artifact.
Capture Requirements
Wireless capture requires an adapter in monitor mode (not promiscuous mode, which only lifts the MAC filter on a wired NIC), locked to a specific channel or hopping across channels.
Tool Role
airodump-ng (Aircrack-ng suite) Channel hopping discovery, BSSID/ESSID/client enumeration, handshake capture to .cap
- Kismet Passive multi-radio detection, rogue/hidden SSID discovery, long-term logging with GPS
- Wireshark / tshark Frame-level dissection with the wlan and radiotap dissectors
- Spectrum analyzer (e.g. Wi-Spy, Ekahau) Layer-1 RF energy — the only way to see jamming
- WIDS/WIPS (Cisco, Aruba, Meraki) Continuous infrastructure-side rogue and anomaly detection
The radiotap header prepended by the capture driver carries RSSI, channel, and data rate per frame — the signal-strength values that make physical-location analysis possible.
Wireless Security Protocol Weaknesses
Protocol Cipher Core weakness
WEP RC4, 24-bit IV The IV space is only ~16.7 million values, so IVs repeat; statistical attacks recover the key from enough captured frames in minutes. Broken beyond any use.
WPA (TKIP) RC4 + per-packet key mixing Interim retrofit for WEP hardware; Michael MIC is weak, vulnerable to Beck-Tews style attacks. Deprecated.
WPA2-PSK AES-CCMP Cipher is sound; the four-way handshake is capturable and the PSK is then attacked offline with a dictionary or mask. KRACK (2017) attacked handshake key reinstallation.
WPA2-Enterprise AES-CCMP + 802.1X/EAP Strong, but misconfigured supplicants that do not validate the RADIUS server certificate fall to evil-twin credential theft.
WPA3-SAE AES + SAE (Dragonfly) Resists offline dictionary attack; forward secrecy; 802.11w PMF mandatory , which blocks deauthentication. Transition mode re-exposes WPA2 weaknesses.
Why the four-way handshake matters to an examiner: decrypting captured WPA2 data traffic requires the PSK and a capture containing the complete four-way handshake for that client session. A capture started after a client associated cannot be decrypted for that session.
Warning
Forcing a reassociation by transmitting deauthentication frames is an active, disruptive technique that denies service to a live client and can constitute unauthorized interference. Perform it only under explicit written authorization and document it in the case notes; a passive capture that waits for natural reassociation is the default.
Rogue Access Points vs. Evil Twins
These are constantly confused, and the distinction drives the entire detection method.
Rogue AP Evil Twin
Definition An unauthorized AP physically connected to the organization's wired network An attacker-operated AP impersonating a legitimate SSID (and often BSSID), not connected to the corporate wire
Threat Bypasses perimeter controls; creates an unmonitored path into the LAN Harvests credentials and performs man-in-the-middle on clients that associate
Wireless detection Unknown BSSID broadcasting a corporate or any SSID in the facility Duplicate SSID with a different BSSID , or the same BSSID with a different RSSI pattern and different channel
Wired detection This is the key test — trace the AP's MAC to a switch port via the CAM table, or correlate wireless BSSID to a wired MAC in the same OUI range Not present on the wired network at all
Corroboration %PORT_SECURITY-2-PSECURE_VIOLATION , an unexpected MAC OUI on an access port, or an unauthorized DHCP server appearing Clients reporting certificate warnings; a captive portal that does not match the corporate one
An AP honeypot is the evil twin's promiscuous cousin: it responds to any probe request with a matching probe response, so a client searching for Home_WiFi , Airport_Free , and CorpNet receives an affirmative answer to all three and associates. The capture signature is unmistakable — one BSSID answering probe requests for many unrelated SSIDs .
Misconfigured access points round out the blueprint's list: an AP left on WEP or open authentication, broadcasting a default SSID and default administrative credentials, with WPS PIN enabled (brute-forceable), or bridging the guest VLAN into the corporate VLAN. These are found by configuration audit and by comparing every AP's advertised capabilities in beacon frames against the approved baseline.
Access Point and Client MAC Spoofing
A MAC address is a 6-byte field an attacker sets at will ( ifconfig wlan0 hw ether , macchanger ). Spoofing defeats MAC allow-listing and lets an evil twin present a legitimate BSSID. Detection relies on the properties the attacker cannot clone:
Sequence-number analysis. Every 802.11 frame carries a 12-bit sequence number that increments monotonically per transmitter. Two devices using one MAC produce interleaved, discontinuous sequence streams — jumps backward and forward that a single radio never generates. This is the single most reliable spoofing indicator.
Signal strength (RSSI) fingerprinting. A stationary AP delivers a stable RSSI to a given sensor. A spoofed frame arriving from a different physical location shows a markedly different RSSI, and plotting RSSI over time reveals two distinct clusters for one MAC.
Simultaneous appearance. The same MAC associated to two APs on opposite sides of a building at the same instant is physically impossible for one device.
Capability and fingerprint mismatch. Beacon intervals, supported-rate sets, information-element ordering, and vendor-specific IEs differ between hardware. A cloned BSSID whose beacon IEs do not match the genuine AP's is a forgery.
Timing/clock skew. The 802.11 timestamp field in beacons reveals per-radio clock drift; two different radios claiming one BSSID show inconsistent drift curves.
Deauthentication and Disassociation Attacks
Because management frames are unauthenticated below 802.11w, anyone can transmit a deauthentication frame spoofing the AP's BSSID, and clients obey it.
Purposes: force reassociation to capture the four-way handshake; push clients onto an evil twin; deny service.
Capture signature:
A high volume of type 0 / subtype 12 (deauthentication) or subtype 10 (disassociation) frames.
Common reason codes: 7 (class 3 frame received from nonassociated STA) and 1 (unspecified).
Broadcast destination ff:ff:ff:ff:ff:ff targets every client at once; a unicast destination targets one victim, which is stealthier and more indicative of a targeted evil-twin push.
The temporal pattern that makes the case: deauthentication burst → client disassociation → reassociation to a different BSSID advertising the same SSID .
WIDS/WIPS consoles log this as a "deauthentication flood" or "management frame anomaly." 802.11w PMF cryptographically protects deauthentication and disassociation frames, so a WPA3 network simply ignores the forged frames.
Signal Jamming: The Attack With No Frames
RF jamming floods the channel with noise or continuous energy so that carrier sense never clears. It operates at Layer 1 , so there is nothing to capture with a protocol analyzer — a packet capture of a jammed channel is simply empty.
Evidence sources:
- Source Indicator
- Spectrum analyzer Continuous elevated noise floor across the channel with no valid 802.11 frame structure
Controller/AP telemetry Channel utilization near 100% with near-zero successful frame throughput; a collapsed signal-to-noise ratio
Client behavior Every client on one channel loses connectivity simultaneously while clients on other channels operate normally
Retry counters Retransmission rate spiking toward 100% immediately before total loss
The distinguishing test: a deauthentication attack produces a flood of frames ; a jamming attack produces an absence of frames with a raised noise floor . Both cause clients to drop, and the exam expects you to separate them by that signature. A jamming event confined to one channel while adjacent channels are healthy also rules out a general hardware or power failure.
Investigating Wireless Traffic: A Working Sequence
Preserve infrastructure telemetry first — WLC/WIDS logs, RADIUS accounting, and AP association tables, all of which age out.
Enumerate the RF environment with a channel-hopping passive capture ( airodump-ng , Kismet) and record GPS or floor position for each sensor.
Baseline the authorized estate — every approved BSSID, channel, and security configuration — so anything outside it is by definition suspect.
Triage anomalies: duplicate SSIDs on unexpected BSSIDs, unknown BSSIDs, deauthentication bursts, one BSSID answering many SSID probes.
Test the wired side for rogue APs: search switch CAM tables for the AP's MAC or OUI and check port-security violations.
Analyze sequence numbers and RSSI on any MAC appearing suspicious to confirm or exclude spoofing.
Correlate to client evidence — endpoint wireless profile history, Windows netsh wlan show profiles and the WLAN-AutoConfig operational log, macOS com.apple.wifi preference plists and known-network lists — to prove which device associated to the hostile AP and when.