Wi-Fi Deauth Attacks: Deauth Frames & 802.11w Defense

Anyone within radio range of a Wi-Fi network can knock your laptop off it in seconds, without knowing the password, without ever joining the network, and with tools that have existed for well over a decade. The technique is the deauthentication attack, and it exploits a decision baked into the original Wi-Fi standard: certain control messages were never authenticated.

The attack is simple, cheap, and still works against a large share of networks in the field. It is also completely preventable with a standard that has been available for years. This guide covers how the attack works, what it is used for, and how to shut it down.

How Wi-Fi manages connections

An 802.11 wireless network uses three kinds of frames. Data frames carry your traffic. Control frames coordinate access to the shared radio channel. Management frames handle the housekeeping of joining and leaving a network: beacons that advertise the network, association requests that join it, and the deauthentication and disassociation frames that end a session.

Deauthentication frames exist for good reasons. An access point needs a way to tell a client "you are no longer connected", for example when it reboots, when a client roams, or when an administrator removes a device. A client needs a way to say the same thing back.

The problem is in how those frames were originally defined. In legacy Wi-Fi, management frames are sent in the clear and carry no signature. A receiving device has no way to check that a deauth frame genuinely came from the access point it thinks it did. If the numbers in the frame look right, the device acts on it.

The attack itself

To forge a deauthentication frame, an attacker needs two pieces of information, both of which travel unencrypted on the air:

• The MAC address of the access point (the BSSID), which is broadcast in every beacon.
• The MAC address of the target client, which appears in the header of every frame that client sends.

A cheap wireless adapter in monitor mode can read both by passively listening to the channel. The attacker then crafts a deauth frame with the access point's address as the source and the client's address as the destination, and transmits it. The client's operating system sees an apparently valid instruction to disconnect and complies. Sending these frames repeatedly keeps the client off the network for as long as the attacker wants.

No password is involved. No prior access to the network is needed. The attacker never authenticates to anything. They only have to be close enough to transmit on the same channel.

What deauth is actually used for

A forced disconnect is annoying on its own, but the attack is usually a means to an end. The forced reconnect that follows is what the attacker wants.

Goal	How deauth enables it	Related technique
Denial of service	Repeated deauths keep devices off the network entirely	Network Denial of Service (T1498)
WPA2 handshake capture	Forcing a reconnect makes the client redo the 4-way handshake, which the attacker captures for offline password cracking	Brute Force (T1110)
Evil twin redirection	Kicking a client off the real access point pushes it to reconnect, where a rogue clone is waiting	Adversary-in-the-Middle (T1557)
Surveillance evasion	Deauthing wireless security cameras drops their feed	Network Denial of Service (T1498)

The handshake capture case is the most consequential. WPA2's four-way handshake happens every time a device joins the network. If an attacker captures that exchange, they can run an offline dictionary or brute-force attack against it at their own pace. They do not need to stay near the network while cracking. Deauthentication is the fastest way to force a fresh handshake on demand rather than waiting for a device to reconnect naturally.

The evil twin case chains directly off deauth as well. A rogue access point that clones a legitimate network's name is more effective when the attacker can force victims off the real one. The deauth provides that push. For the full picture of that follow-on attack, see our evil twin attacks guide.

The fix: 802.11w Protected Management Frames

The root cause is unauthenticated management frames, so the fix authenticates them. The IEEE published amendment 802.11w in 2009 to add Protected Management Frames (PMF). With PMF in place, deauthentication and disassociation frames carry cryptographic protection derived from the keys established when the client joined the network.

A client using PMF checks that protection before acting on a management frame. A spoofed deauth from an attacker who never joined the network cannot produce a valid signature, so the client rejects it and stays connected. The forgery that the whole attack depends on stops working.

The reason PMF was not universal for years is that 802.11w was optional. Networks and devices had to opt in, and many never did. WPA3 changed that. The Wi-Fi Alliance made Protected Management Frames mandatory in WPA3, and required PMF-capable operation in the transition modes that let WPA3 and WPA2 devices coexist. Turning on WPA3, or WPA2 with PMF required where your hardware supports it, is the direct countermeasure.

How to defend against deauthentication attacks

1. Enable WPA3, or WPA2 with PMF required. This is the single control that removes the underlying vulnerability. Everything else is mitigation around the edges.
2. Audit device support before enforcing. Set PMF to required only once you confirm every client supports it, otherwise older devices will fail to connect. Use "optional" as a temporary transition, understanding it is not full protection.
3. Deploy a wireless intrusion detection system (WIDS). A WIDS watches for the flood of deauth frames that signals an active attack and alerts you, so a jamming or evil twin attempt does not go unnoticed. See our rogue access point guide for how wireless monitoring fits together.
4. Reduce signal bleed. Tuning access point power and placement so the network does not radiate far past your walls raises the bar for an attacker who must be in radio range.
5. Treat public and untrusted Wi-Fi as hostile. On networks you do not control, assume a forced disconnect and reconnect could be steering you toward a rogue access point, and rely on a VPN and HTTPS rather than the Wi-Fi layer for confidentiality.

For a broader hardening checklist that covers deauth resistance alongside encryption, passwords, and segmentation, see our guide on how attackers weaponize common file formats and pair it with the wireless steps above.

Why the frames were left unauthenticated

The vulnerability traces back to a design decision in the original 802.11 standard, and understanding it explains why the fix took the form it did. When Wi-Fi was standardized, management frames were treated as low-level housekeeping that had to work before any security association existed. A client has to be able to hear a beacon and begin associating before it shares any key with the access point, so the earliest frames in a session could not depend on a key that has not been negotiated yet. Deauthentication and disassociation were bundled into that same unauthenticated management class for simplicity, even though, unlike a beacon, they are sent during or after a session when a key does exist.

That is the gap the attack exploits. There was no cryptographic binding between a deauth frame and the access point that supposedly sent it, so any device on the channel could assert a disconnect on behalf of the access point. The receiving client had no field to check and no signature to verify, so it acted on the instruction at face value. The design favored getting connections up quickly and interoperating broadly over authenticating every housekeeping message, and the deauth attack is the cost of that choice.

The correction, 802.11w, is narrowly aimed at exactly this. It does not try to authenticate the frames that genuinely must precede a security association, such as beacons and initial probes. It protects the management frames that are exchanged once keys exist, deauthentication and disassociation among them, by deriving protection from the session keys already in place. That is why PMF can only guard a client that has completed the key exchange, and why it cannot prevent every conceivable wireless denial of service, only the forged-disconnect class that this attack relies on.

How the attack evolved

Deauthentication abuse is roughly as old as widely deployed Wi-Fi. Once tools appeared that could put commodity adapters into monitor mode and inject crafted frames, forging a disconnect became trivial, and it stayed trivial because the underlying design did not change for years. The technique became a staple of wireless assessments and of casual disruption alike, precisely because it needed no password and cost almost nothing.

The defensive answer arrived in 2009 when the IEEE published the 802.11w amendment adding Protected Management Frames. For a long time it changed little in practice, because the amendment was optional and adoption was slow. Devices and networks that never enabled it stayed exactly as vulnerable as before. The decisive shift came when the Wi-Fi Alliance made PMF mandatory in WPA3 and required PMF-capable operation in the transition modes that let WPA3 and WPA2 devices share a network. That turned the fix from an obscure toggle into a baseline expectation, so the attack's long reign is finally narrowing as WPA3-capable hardware replaces older gear.

A worked example: deauth into handshake capture

Walking through the most consequential use of deauth, capturing a WPA2 handshake, shows why the forced reconnect is the real objective rather than the disconnect itself.

The attacker begins by putting a wireless adapter into monitor mode, which lets it receive all frames on a channel rather than only those addressed to it. Listening passively, the adapter reads the beacons that every access point broadcasts, which reveals each network's name and its BSSID, the access point's MAC address. It also sees the data frames that connected clients send, and every one of those frames carries the client's MAC address in its header. At this point the attacker knows both addresses the forgery needs, and has transmitted nothing.

Next the attacker crafts a deauthentication frame that names the access point as the source and a chosen client as the destination, and sends it on the channel. The client's operating system receives what looks like a valid instruction from its access point and disconnects. Because devices are configured to rejoin their known networks automatically, the client almost immediately begins reconnecting.

Reconnecting means repeating the WPA2 four-way handshake, the exchange that establishes the session keys from the shared passphrase. The attacker's adapter, still listening in monitor mode, captures that handshake as it happens. The captured handshake does not contain the passphrase. It contains values derived from it, which is enough to test candidate passphrases offline.

With the handshake saved, the attacker leaves. The cracking happens elsewhere, at whatever pace their hardware allows, testing dictionary words and then brute-force combinations against the captured exchange. A weak or common passphrase falls quickly. A long, random one may never fall. The deauth did not break the encryption. It compressed the waiting: rather than lingering near the network hoping a device would reconnect on its own, the attacker forced a fresh handshake on demand. That is the whole value of the technique in this chain, and it maps to Brute Force (T1110) for the offline stage.

How to detect a deauth attack

Because the frames themselves are indistinguishable from legitimate ones in their format, detection watches for volume and context rather than content.

• A burst of deauthentication or disassociation frames aimed at one client or broadcast to many is the primary signal. Normal networks send these occasionally; a flood is anomalous.
• Deauths that do not match network events. A legitimate deauth usually accompanies a reboot, a roam, or an administrative action. A stream of disconnects with no corresponding infrastructure event is suspicious.
• Repeated forced reconnect cycles for one or more clients, especially clients that were stable moments before.
• Deauths sourced from a BSSID during a period the access point did not initiate them, which a controller-aware sensor can correlate.
• Concurrent appearance of a duplicate network name on a different BSSID, which suggests the deauth is the setup for an evil twin.

A wireless intrusion detection system automates this by watching every channel and comparing management-frame activity against a baseline. Without a WIDS, a deauth flood typically shows up only as users reporting that Wi-Fi keeps dropping, which is a late and ambiguous signal.

Deauth compared to related wireless attacks

Placing deauth beside neighboring techniques clarifies what it does and does not do.

Attack	What it does	Needs network access	Stopped by
Deauthentication	Forges disconnect frames to knock clients off	No	802.11w PMF, WPA3
Evil twin	Runs a rogue clone of a network to capture traffic	No	Network authentication, PMF, user vigilance
Handshake capture	Records the WPA2 four-way handshake for offline cracking	No	Strong passphrase, WPA3
RF jamming	Floods the spectrum with noise to deny service	No	Spectrum monitoring, hard to fully prevent
Rogue access point (bridged)	Plugs an unauthorized AP into the wired network	Yes, physical	802.1X, WIDS

Deauth sits at the enabling end of this list. It rarely achieves the attacker's final goal by itself, and it is the lever that makes handshake capture fast and evil twin redirection reliable. Jamming achieves a similar denial-of-service effect by brute force, and it is cruder and easier to detect as raw interference.

Common misconceptions

"A strong Wi-Fi password stops deauth." It does not. The password protects the data and the handshake, and it has no bearing on management frames, which in legacy Wi-Fi are unauthenticated. A network with a very strong passphrase is still fully vulnerable to being deauthed unless Protected Management Frames are enforced.

"WPA2 encryption prevents it." WPA2 encrypts data frames and leaves management frames unprotected by default. The disconnect message is forgeable on an otherwise fully encrypted WPA2 network. Closing the gap requires 802.11w, which WPA3 makes mandatory.

"Deauth lets the attacker read my traffic." By itself it does not. It disconnects you. Reading traffic requires a follow-on step, such as luring you onto an evil twin after the disconnect, or cracking a captured handshake to derive the key. The deauth is the setup for those, not the payoff.

"Only expensive gear can do this." An inexpensive wireless adapter that supports monitor mode and packet injection is enough, and the software is freely available. The low cost is part of why the technique remains common.

Frequently asked questions

Does a deauth attack require the Wi-Fi password? No. That is what makes it so accessible. The attacker only needs to be in radio range and to read two MAC addresses that travel in the clear on the air, the access point's BSSID and the target client's address. No authentication to the network is involved at any point.

What is the actual fix for deauth attacks? 802.11w Protected Management Frames, which cryptographically protect deauthentication and disassociation frames so a spoofed one is rejected. WPA3 makes PMF mandatory, so enabling WPA3, or WPA2 with PMF required where every client supports it, removes the underlying vulnerability. The Wi-Fi Alliance security overview covers WPA3 and PMF.

Why does the attack still work on so many networks? 802.11w was optional for years, so many networks and devices never enabled it. Mixed environments with older clients often run PMF in optional mode, which lets unprotected fallback continue for any device that does not support it. Until the last legacy device is retired and PMF is set to required, the network stays exposed.

Is deauthentication the same as jamming? No. Jamming floods the radio spectrum with noise to deny service to everything on the channel, and it is a blunt physical attack. Deauthentication is a targeted protocol attack that sends a small number of forged frames to disconnect specific clients, and it is far more surgical and efficient, though it also enables follow-on attacks that jamming does not.

Can I detect a deauth attack without special equipment? Detecting it reliably needs a wireless intrusion detection capability that watches management-frame activity, which many managed access points provide. Without that, the only symptom you are likely to see is users reporting repeated disconnects, which is a late and ambiguous indicator. Dedicated airspace monitoring turns it into a specific alert.

Does PMF slow down my network or break devices? PMF adds negligible overhead. The practical concern is compatibility: a client that does not support PMF cannot connect when PMF is set to required. This is why you audit device support first, use optional mode only as a temporary transition, and enforce required once every device on the network can handle it.

What maps this attack to a security framework? The denial-of-service effect maps to Network Denial of Service (T1498). The follow-on offline password cracking maps to Brute Force (T1110), and the evil twin redirection it enables maps to Adversary-in-the-Middle (T1557). The deauth is the common setup step across these.

Does a VPN protect me from deauth attacks? A VPN protects the confidentiality of your traffic, so it limits what an attacker gains from an evil twin that you might be pushed onto after a disconnect. It does not stop the deauth itself, because the forged frame operates at the Wi-Fi layer below the VPN. On untrusted networks, treat a VPN and HTTPS as your confidentiality layer and assume the wireless link can be disrupted or steered. Establishing wireless robust security networks is covered in NIST SP 800-97.

Deauthentication is one of the oldest tricks in wireless attacking, and it survives because so many networks still run management frames unprotected. The remedy has shipped and is mandatory in WPA3. Turn on Protected Management Frames, retire the legacy devices that block you from enforcing it, and the classic deauth attack simply stops working against you.

Related guides

• Evil Twin Attacks Explained
• Rogue Access Point Explained
• How to Secure Your Wi-Fi
• WPA3 Explained