Wi-Fi Deauthentication Attacks

How attackers can deliberately disconnect devices from wireless networks

Introduction

Wi-Fi networks are designed to allow devices to connect, communicate and disconnect from wireless networks dynamically.

However, some of the management mechanisms used by Wi-Fi can also be abused by attackers.

One example is the Wi-Fi deauthentication attack, commonly shortened to a deauth attack.

A deauthentication attack deliberately causes wireless devices to disconnect from an access point. At first glance, repeatedly disconnecting a laptop or smartphone might not seem particularly serious, however, deauthentication attacks can be used for several purposes, including:

  • Disrupting wireless connectivity
  • Causing a denial-of-service condition
  • Forcing devices to reconnect
  • Supporting Evil Twin attacks
  • Disrupting wireless networks in operational environments
  • Creating opportunities to capture authentication traffic

Understanding how deauthentication works is therefore important for anyone involved in wireless networking or cyber security.

What is Wi-Fi Deauthentication?

Before understanding the attack, we first need to understand what deauthentication actually means.

When a device connects to a Wi-Fi network, it establishes a relationship with the wireless access point.

The access point needs to know which devices are connected and maintain information about those connections. To achieve this, Wi-Fi access points use a number of management frames to control the relationship between wireless devices and access points.

One of these is the deauthentication frame.

A legitimate deauthentication message essentially tells a wireless device “Your authenticated connection with this access point is ending.“

Normally, this might happen when:

  • A user disconnects from Wi-Fi
  • A device moves to another network
  • An access point shuts down
  • A network administrator makes a configuration change
  • A device needs to reconnect

The problem is that, historically, these management frames were not always adequately protected.

This creates an opportunity for attackers.

So, What Is a Deauthentication Attack?

A Wi-Fi deauthentication attack occurs when an attacker sends forged deauthentication frames to a wireless client or access point in an attempt to terminate their connection.

The attacker is effectively attempting to convince a device that its Wi-Fi connection has been terminated

The device may then disconnect from the network and then attempt to reconnect.

The attacker does not necessarily need to know the user’s Wi-Fi password because the attack abuses the wireless management process used to maintain connections.

How does a Deauthentication attack work?

A simplified attack can be broken down into several stages.

  1. Identify the Wireless Network – The attacker first identifies a nearby wireless network and the devices connected to it. This can reveal information such as the SSID, the AP, the wireless channel in use, any connected clients, and their MAC addresses
  2. Identify a Target – The attacker may target a specific wireless client, multiple clients, the access point, or the entire wireless network
  3. Send Forged Deauthentication Frames – The attacker transmits specially crafted wireless management frames which appear to indicate that the connection should be terminated.
  4. Client Disconnects – If the device accepts the frame, it may disconnect from the wireless network.
  5. Device Attempts to Reconnect – Many devices automatically attempt to reconnect to their preferred wireless network. This is where deauthentication attacks can become particularly useful as part of a larger attack.

Why would an attacker perform a Deauthentication attack?

A deauthentication attack can have several objectives.

  • Denial of Service – The simplest purpose is disruption. By repeatedly disconnecting devices, an attacker can prevent users from maintaining a reliable wireless connection.
  • Forcing Devices to Reconnect – An attacker may deliberately disconnect a device so that it immediately attempts to reconnect. This can be useful when the attacker is conducting another wireless attack. The deauthentication attack therefore becomes a supporting technique rather than the final objective.
  • Supporting an Evil Twin Attack – One particularly important relationship is between deauthentication and Evil Twin attacks. An attacker may create a rogue access point using a similar or identical SSID to a legitimate network. By disrupting the victim’s legitimate connection, the victim’s device may subsequently search for the network again and potentially encounter the attacker’s rogue access point.

Deauthentication vs Disassociation

It is important to distinguish between deauthentication and disassociation. Both are Wi-Fi management mechanisms, but they occur at different stages of the wireless connection process.

Deauthentication terminates the authenticated relationship between the client and access point. The device generally needs to authenticate again before establishing a new connection.

Disassociation terminates the association between the client and access point. The device may still remain authenticated and can potentially reassociate.

Attackers may abuse either type of management frame depending on their objective.

Why are these attacks possible?

The fundamental problem historically involved the protection of 802.11 management frames. Early Wi-Fi security mechanisms focused heavily on protecting the actual data being transmitted.

However, certain management frames were not necessarily protected in the same way.

An attacker could therefore transmit a forged management frame that appeared to originate from a legitimate wireless device. The receiving device could potentially accept the message and disconnect.

Protected management frames

Modern Wi-Fi standards introduced Protected Management Frames (PMF) to address this problem. PMF provides mechanisms for protecting certain management traffic from spoofing and manipulation.

It is associated with IEEE 802.11w and is incorporated into modern Wi-Fi security technologies.

When PMF is properly implemented, an attacker has a much harder time successfully forging protected deauthentication and disassociation frames – This significantly reduces the effectiveness of traditional deauthentication attacks.

WPA2 and WPA3

The security configuration of the wireless network is extremely important. Modern wireless networks can use stronger protections against management-frame attacks.

WPA3 incorporates stronger security requirements, including protection for management frames.

WPA2 networks can also support Protected Management Frames, although the exact configuration and enforcement depend on the deployment.

For organisations, simply selecting WPA2 or WPA3 is therefore not the whole story.

Administrators should also consider:

  • PMF configuration
  • Whether PMF is optional or required
  • Client compatibility
  • Access-point capabilities
  • Wireless intrusion detection
  • Network monitoring

How can Deauthentication attacks be detected?

A single Wi-Fi disconnection does not necessarily indicate an attack – devices disconnect for many legitimate reasons. However, repeated or unusual patterns can provide useful indicators.

Security teams should look for:

  • Large numbers of deauthentication frames
  • Repeated disconnections
  • Multiple clients disconnecting simultaneously
  • Unexpected changes in wireless behaviour
  • Deauthentication traffic from unusual sources
  • Multiple devices repeatedly reconnecting
  • Sudden wireless disruption in a specific area

Wireless intrusion detection

Organisations operating larger wireless environments can deploy Wireless Intrusion Detection Systems (WIDS) or Wireless Intrusion Prevention Systems (WIPS).

These systems can monitor wireless activity for suspicious behaviour.

They may identify:

  • Rogue access points
  • Evil Twin networks
  • Excessive deauthentication
  • Suspicious management frames
  • Unknown wireless devices
  • MAC address anomalies
  • Unusual wireless traffic patterns

This provides another layer of protection beyond the wireless encryption itself.

How can organisations prevent Deauthentication attacks?

Organisations can reduce the risk of DeAuth attacks by implementing several controls.

  • Use Protected Management Frames – Where supported, enable PMF and preferably configure it to required rather than merely optional where the environment allows. This provides protection against many spoofed management-frame attacks.
  • Use WPA3 Where Practical – WPA3 provides stronger wireless security and incorporates modern protections against management-frame attacks.
  • Deploy Wireless Monitoring – WIDS/WIPS technologies can help identify suspicious wireless activity.
  • Monitor Repeated Disconnects – Large numbers of simultaneous wireless disconnections can indicate an attack.
  • Segment Wireless Networks – Separating corporate, guest and IoT wireless networks can reduce the impact of a wireless compromise.
  • Educate Users – Users should understand that unexpected Wi-Fi disconnections can sometimes be security-relevant.

Deauthentication Attacks and Public Wi-Fi

Public Wi-Fi environments can be particularly interesting to attackers. A user may have previously connected to the legitimate network and configured their device to automatically reconnect to it whenever it is nearby.

An attacker could attempt to disrupt legitimate connectivity and use the resulting reconnection behaviour as part of a wider wireless attack.

This is one reason users should not automatically trust a familiar SSID – The name of a Wi-Fi network does not prove that the network is legitimate.

Are Deauthentication attacks still effective?

Yes, but their effectiveness depends heavily on the wireless security configuration.

Traditional attacks against unprotected management frames can be significantly reduced when Protected Management Frames are properly implemented. However, organisations cannot assume that every wireless device, access point or legacy network is configured securely.

Older equipment, poorly configured networks and environments containing legacy devices may still present opportunities for attackers.

Conclusion

A Wi-Fi deauthentication attack abuses wireless management mechanisms to deliberately disconnect devices from an access point.

The simplest objective is to disrupt connectivity and create a denial-of-service condition. However, the technique can also be used as part of a broader attack chain, particularly when combined with Evil Twin networks, captive portals and credential phishing.

Modern protections such as Protected Management Frames (PMF) significantly reduce the effectiveness of traditional spoofed deauthentication attacks.

However, secure wireless networking requires more than simply selecting WPA2 or WPA3.

Organisations should consider management-frame protection, wireless monitoring, network segmentation, appropriate authentication and user awareness.