If the ESP8266 detects deauthentication or disassociation frames it will turn on its LED. That's all ¯\ (ツ)/¯. So this is a good and cheap way to detect a Wi-Fi deauthentication attack.