> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/hacking-wifi/wpa-wpa2-psk-network-attacks/packet-analysis/deauthentication-packet-analysis.md).
# 取消身份验证数据包分析
在授权捕获中识别并解读 Wi-Fi 取消身份验证帧。
### 概述
去认证帧会结束现有的 802.11 认证关系。接入点或客户端都可以发送此管理帧。
该帧包含一个原因代码。此代码描述了发送方为何结束该关系。
分析您拥有或被授权评估的网络中的抓包。
### 过滤去认证帧
去认证帧使用管理帧子类型 `12`。使用 Tshark 过滤已保存的捕获：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 12" 2>/dev/null
```
{% endcode %}
### 列出目标 MAC 地址
从匹配的帧中提取唯一的目标地址：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 12" -Tfields -e wlan.da 2>/dev/null | sort -u
```
{% endcode %}
### 检查特定客户端
过滤包含客户端 MAC 地址的帧：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 12 && wlan.addr == AA:BB:CC:DD:EE:FF" 2>/dev/null
```
{% endcode %}
替换 `AA:BB:CC:DD:EE:FF` 使用你授权捕获中的客户端 MAC 地址。
### 查看数据包字段
使用详细输出查看帧详情：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 12" -V 2>/dev/null
```
{% endcode %}
查看以下字段：
* **源地址** 标识帧发送方。
* **目的地址** 标识受影响的客户端或广播目标。
* **BSSID** 标识相关的接入点。
* **原因代码** 标识去认证的声明原因。
### 解读结果
去认证帧确认发送方已结束一个 802.11 认证关系。仅凭这一点，并不能确定其根本原因。
检查原因代码、源地址以及附近的帧。将该事件与同一客户端的解除关联、认证和关联流量进行关联分析。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/hacking-wifi/wpa-wpa2-psk-network-attacks/packet-analysis/deauthentication-packet-analysis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
