Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.
What is a deauthentication attack?
Wi-Fi networks use management frames — small control messages like "deauthenticate" and "disassociate" — to manage connections between clients and access points. In older protocol versions these frames are neither authenticated nor encrypted, so an attacker within radio range can forge them. By sending spoofed deauthentication frames that appear to come from the access point (or from a client), the attacker forces devices to drop their connection, causing denial of service or repeated reconnections.
Why attackers use them
Deauthentication is rarely the end goal. Conceptually, attackers use it for two things: disruption (knocking users off a network, sometimes repeatedly, as harassment or sabotage) and facilitation — forcing clients to reconnect so the attacker can capture fresh handshake traffic or nudge users toward a rogue access point. What may look like "just kicking someone off Wi-Fi" is the same mechanism used in credential-theft attacks.
What deauth attacks look like in your logs
- A flood of deauth/disassoc frames in access point logs — far more than normal roaming would generate.
- Repeated client drops and reconnects clustered in time, especially affecting many devices at once.
- Source MACs that don't match any associated device, or frames attributed to the AP that arrive at abnormal rates.
- Wireless IDS alerts for "spoofed management frames" or deauthentication floods, if a WIDS is deployed.
How to protect your network
- Enable Protected Management Frames (802.11w) on your access points and clients — this cryptographically protects deauth and disassoc frames so forged ones are ignored. WPA3 mandates it; many WPA2 devices support it as an option.
- Deploy wireless intrusion detection (or at least monitor AP logs) so deauth floods trigger alerts instead of going unnoticed.
- Keep firmware current on routers and access points to ensure management-frame protections are actually available and patched.
- Use strong authentication (WPA3, or WPA2 with a long unique passphrase) so that even forced reconnections don't expose you to handshake-guessing attacks.
- For organizations: consider wireless IPS with automatic containment of rogue APs and RF containment policies for repeated deauth sources.
Authorization disclaimer
All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Transmitting deauthentication frames against networks you don't own disrupts other people's connectivity and is illegal in most jurisdictions.
EmoticonEmoticon