> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/hacking-wifi/wpa-wpa2-psk-network-attacks/packet-analysis/disassociation-packet-analysis.md).
# 解除关联数据包分析
在授权捕获中识别并解读 Wi-Fi 解除关联帧。
### 概述
解除关联帧会结束客户端与接入点之间的关联。客户端将无法再通过该关联交换常规数据。
与去认证不同，解除关联不会终止 802.11 认证关系。客户端之后可以再次进行认证并重新关联。
分析您拥有或被授权评估的网络中的抓包。
### 过滤解除关联帧
解除关联帧使用管理帧子类型 `10`。使用 Tshark 过滤已保存的捕获：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 10" 2>/dev/null
```
{% endcode %}
### 列出目标 MAC 地址
从每个匹配的帧中提取目标地址：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 10" -Tfields -e wlan.da 2>/dev/null | sort -u
```
{% endcode %}
### 检查特定客户端
过滤包含客户端 MAC 地址的帧：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 10 && wlan.addr == AA:BB:CC:DD:EE:FF" 2>/dev/null
```
{% endcode %}
替换 `AA:BB:CC:DD:EE:FF` 使用你授权捕获中的客户端 MAC 地址。
### 查看数据包字段
使用详细输出查看帧详情：
{% code overflow="wrap" %}
```bash
tshark -r CAPTURE-01.cap -Y "wlan.fc.type_subtype == 10" -V 2>/dev/null
```
{% endcode %}
查看以下字段：
* **源地址** 标识帧发送方。
* **目的地址** 标识受影响的客户端或广播目标。
* **BSSID** 标识相关的接入点。
* **原因代码** 标识所述的解除关联原因。
### 解读结果
解除关联帧确认关联已结束。它不会显示客户端随后是否重新连接。
查看原因代码、源地址和附近的帧。将该事件与同一客户端后续的认证和关联流量进行关联分析。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/hacking-wifi/wpa-wpa2-psk-network-attacks/packet-analysis/disassociation-packet-analysis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
