What Is a Deauthentication Attack?
A deauthentication attack forces devices off a Wi-Fi network by forging the management frames that tell a client to disconnect. In older Wi-Fi, those frames are unauthenticated — so anyone within range can spoof them and repeatedly kick clients off. It is a denial-of-service technique in its own right, and frequently the opening move for a larger attack.
How does it work?#
The 802.11 protocol uses deauthentication frames to legitimately end a connection. The flaw is that classic Wi-Fi does not authenticate these frames:
- The attacker spoofs a deauth frame appearing to come from the access point.
- The target client obediently disconnects.
- Repeating this keeps devices off the network entirely (a DoS).
More importantly, forcing a reconnection lets the attacker capture the WPA2 handshake for offline cracking, or push the victim toward a rogue access point they control.
What does it enable?#
| Goal | How deauth helps |
|---|---|
| Denial of service | Keep devices disconnected |
| Handshake capture | Force reconnect, grab the 4-way handshake |
| Rogue AP / evil twin | Push clients to a malicious network |
How is it defended?#
The structural fix is Protected Management Frames (802.11w), mandatory in WPA3. By authenticating management frames, it makes forged deauth packets fail — closing an attack that plagued Wi-Fi for years.
Deauth attacks target the wireless link layer. More at the Network Security hub.
Frequently asked questions#
What is a deauthentication attack?
A deauth attack sends forged 802.11 deauthentication frames to knock devices off a Wi-Fi network. In older Wi-Fi, these management frames are unauthenticated, so anyone nearby can spoof them, repeatedly disconnecting clients. It is a denial-of-service attack and often a stepping stone to capturing a handshake or luring devices to a rogue access point.
How does WPA3 stop deauth attacks?
WPA3 (and the 802.11w Protected Management Frames feature) authenticates management frames, so forged deauth packets are rejected. On networks using Protected Management Frames, the classic deauth attack no longer works. Older WPA2 networks without this protection remain vulnerable.