A deauthentication (deauth) attack is a type of wireless (Wi-Fi) denial-of-service (DoS) attack where an attacker sends deauthentication frames (IEEE 802.11 management frames) to disconnect clients from a wireless access point (AP). Deauth frames are legitimate management frames used by APs to disconnect clients (e.g., when switching channels, shutting down). Attackers exploit the lack of authentication in 802.11 management frames (deauth frames are not encrypted). This attack is primarily used to capture WPA/WPA2 4-way handshake for password cracking (WPA/WPA2 password recovery).
Attack Prevalence: Deauth attack is the primary method for WPA handshake capture (90% of WPA cracking). 80% of public Wi-Fi networks are vulnerable to deauth attacks (no PMF - Protected Management Frames).
Common purposes of deauthentication attacks:
// Deauthentication attack technical flow
1. Attacker puts wireless card in monitor mode
sudo airmon-ng start wlan0
2. Attacker scans for target AP and clients
sudo airodump-ng wlan0mon
3. Attacker sends deauth frames to target client
sudo aireplay-ng -0 10 -a AP_MAC -c Client_MAC wlan0mon
4. Client disconnects from AP (reason code 7)
5. Client automatically reconnects within 10-30 seconds
6. During reconnection, attacker captures 4-way handshake
7. Attacker cracks WPA password offline (aircrack-ng, hashcat)
// Deauth frame reason codes (IEEE 802.11)
Reason code 0: Reserved
Reason code 1: Unspecified reason
Reason code 4: Disassociated due to inactivity
Reason code 5: Disassociated because AP is unable to handle all associated STAs
Reason code 7: Class 3 frame received from nonassociated STA
Reason code 8: Disassociated because sending STA is leaving BSS
Sends deauth frames to specific client MAC address. Client disconnects, attacker captures handshake. Command: aireplay-ng -0 10 -a AP_MAC -c Client_MAC wlan0mon.
Sends deauth frames to broadcast MAC (FF:FF:FF:FF:FF:FF). All clients disconnect. Useful for capturing multiple handshakes simultaneously.
Captures PMKID from AP without deauth attack. Tool: hcxdumptool + hashcat. Faster than traditional handshake capture. Requires AP with WPA2-PSK.
aireplay-ng -0 (deauth) sends deauthentication frames. Command: aireplay-ng -0 10 -a AP_MAC -c Client_MAC wlan0mon. Captures handshake for offline cracking.
mdk4 wlan0mon d -E (deauth flood) - high-speed deauth attack. Supports broadcast and targeted deauth, WPA handshake capture.
Automated wireless attack tool. Automatically captures WPA handshake (deauth attack) and cracks password with wordlist.
This demonstration simulates a deauthentication attack to capture WPA2 handshake:
This is a simulated demonstration. Real deauthentication attacks send 802.11 management frames to disconnect clients. Protect yourself by enabling Protected Management Frames (PMF - 802.11w), using WPA3 (SAE encryption), and monitoring for deauth attacks (WIDS/WIPS).
Monitor for excessive deauthentication frames (IEEE 802.11 management). Snort rule: content:"|C0 00|" (deauth frame). Detect aireplay-ng deauth attack pattern.
802.11w encrypts management frames (including deauth). Prevents deauth attacks (requires WPA2/WPA3). Clients must support PMF.
802.11w encrypts management frames (deauth, disassoc). Prevents deauth attacks. Requires WPA2-Enterprise or WPA3. Supported by modern devices (2018+).
WPA3-Enterprise uses Protected Management Frames (PMF) by default. WPA3-Personal with SAE encryption also supports PMF.
Deploy Wireless Intrusion Detection System (WIDS). Detect large numbers of deauth frames (threshold 100 per minute).
Best Practice - Enable PMF (802.11w): Enable Protected Management Frames (PMF) on your wireless infrastructure (APs and clients). PMF encrypts deauthentication frames, preventing deauth attacks. WPA3 includes PMF by default (mandatory). WPA2 networks with 802.11w support can also enable PMF.
Deauthentication attacks (unauthorized wireless disruption) are illegal in all jurisdictions:
Deauthentication attacks are illegal and unethical. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized deauthentication attacks are illegal.
Official documentation: aireplay-ng deauthentication attack, handshake capture, WPA cracking.
IEEE 802.11w amendment adding encryption for management frames (deauth, disassoc).