How a single forged management frame can knock devices off your Wi-Fi — why it works, what it enables, and why older gear that doesn’t support Protected Management Frames can’t be fully fixed.
Wi-Fi Deauthentication Attacks — and How to Defend Against Them
A deauthentication (deauth) attack is one of the oldest and simplest Wi-Fi attacks — and it still works against a huge amount of equipment today. With cheap hardware and free software, an attacker can force devices to disconnect from a wireless network repeatedly, causing anything from mild annoyance to a stepping stone for far more serious attacks. Understanding how it works explains both why it’s so effective and why prevention is not always straightforward.
What a Deauthentication Frame Actually Is
Wi-Fi uses small management frames to organise connections — joining a network, leaving it, and housekeeping in between. One of these is the deauthentication frame: a legitimate message that tells a device “you are now disconnected.” It exists for good reasons, such as an access point cleanly dropping a client.
The problem is historical. In the original 802.11 standard, these management frames were sent unencrypted and unauthenticated. There was no way for a device to verify that a “disconnect” message genuinely came from the access point. So an attacker can simply forge one — spoofing the access point’s address — and the target obediently disconnects.
⚠ Important
A deauth attack needs no password and no access to the network. The attacker never joins your Wi-Fi — they only need to be in radio range. Because the frames are part of the standard, even a fully patched, strongly-encrypted WPA2 network is vulnerable unless it also uses Protected Management Frames.
How the Attack Works
The steps are trivially simple for an attacker:
- Put a Wi-Fi adapter into monitor mode and scan the air for nearby networks and connected devices — all of this is passive and invisible.
- Identify the access point’s address (BSSID) and the client devices attached to it.
- Send forged deauth frames spoofing the access point, targeting one device or broadcasting to all of them.
- Repeat continuously to keep devices knocked offline for as long as the attacker stays in range.
Why It Matters — Beyond Just Annoyance
A dropped connection sounds minor, but deauth is often a tool that enables other attacks:
| Use of deauth | What it achieves |
|---|---|
| Denial of service | Keeps devices offline — cameras, POS terminals, VoIP phones, laptops |
| Handshake capture | Forces a reconnect so the WPA handshake can be captured for offline password cracking |
| Evil twin / rogue AP | Kicks a device off the real AP so it reconnects to the attacker’s fake one |
| Disabling cameras | Knocks Wi-Fi security cameras and doorbells offline during a physical break-in |
| Forcing captive portals | Pushes users to a spoofed login page to harvest credentials |
The Real Fix: Protected Management Frames (802.11w)
The proper solution is Protected Management Frames (PMF), defined in the 802.11w amendment. PMF cryptographically protects management frames — including deauth — so a device can verify that a “disconnect” message genuinely came from the access point. A forged deauth frame is simply ignored.
PMF comes in three modes on most equipment:
- Disabled: No protection — the network is fully vulnerable to deauth.
- Optional (capable): Protects devices that support PMF, while still allowing older devices to connect without it.
- Required (mandatory): Every device must support PMF — the strongest setting, but it locks out legacy gear.
✓ Key Point
WPA3 makes PMF mandatory. Moving to WPA3 — or WPA2/WPA3 mixed mode with PMF set to required — is the single most effective defence against deauth attacks. If every device on your network is modern, set PMF to required and the classic deauth attack stops working.
The Legacy Problem: Older Devices Without PMF
Here is the catch that trips up most real-world networks: PMF only helps if every device supports it. A great deal of equipment still in service does not:
- Older laptops, phones and tablets with pre-2018 Wi-Fi chipsets or outdated drivers
- Budget IoT and smart-home devices — plugs, globes, sensors, cameras — that only support WPA2 and no PMF
- Legacy printers, barcode scanners, industrial and medical equipment
- Older Wi-Fi cameras and doorbells — ironically, some of the very devices most useful to disable
This creates a genuine dilemma:
| PMF setting | Effect on legacy devices | Deauth protection |
|---|---|---|
| Required | Legacy devices can’t connect at all | Full — for devices that can connect |
| Optional | Legacy devices still connect | Partial — legacy devices remain exposed |
| Disabled | Everything connects | None |
⚠ Important
Setting PMF to optional to keep old devices online means those old devices are still fully vulnerable to deauth. There is no software patch that retrofits PMF onto a chipset that doesn’t support it — the protection lives in the Wi-Fi hardware and driver. For legacy gear, the honest answer is: you cannot make it immune. You can only work around it.
Working Around Legacy Devices
If you have equipment that can’t do PMF, these strategies reduce the risk without pretending the problem is gone:
- Segregate legacy devices onto their own SSID/VLAN: Run a separate WPA2 network (PMF optional) for old IoT gear, and a WPA3 PMF-required network for everything modern — so a deauth on the old network can’t reach your important devices.
- Move critical devices to wired connections: Cameras, NVRs, POS terminals, servers and anything that must stay online should be on Ethernet, which deauth cannot touch.
- Replace the worst offenders: Security cameras and doorbells that only do WPA2 are exactly what an intruder wants to disable — upgrading these to PMF-capable or wired models is high-value.
- Deploy wireless intrusion detection (WIDS): Business-grade access points can detect deauth floods and rogue APs and alert you, so an attack in progress is noticed rather than silent.
- Prefer 5 GHz / 6 GHz where possible: Doesn’t stop deauth, but reduces exposure to the many cheap 2.4 GHz-only attack tools.
- Plan a retirement path: Treat non-PMF devices as end-of-life for security purposes and phase them out over time.
✓ Key Point
You can’t patch PMF onto old hardware — so contain it instead.
1. WPA3 with PMF required for everything that supports it
2. Isolate legacy WPA2/non-PMF devices on a separate network
3. Put anything critical on wired Ethernet
4. Use WIDS to detect deauth floods, and plan to retire non-PMF gear
Is your Wi-Fi one forged frame away from going dark?
Deauth attacks are cheap, silent, and still work against most legacy gear — including the cameras you’d least want offline. Mobile Techs IT Service audits wireless networks for Gold Coast homes and businesses: enabling WPA3 and Protected Management Frames where supported, isolating legacy devices that can’t be protected, moving critical equipment to wired links, and adding deauth and rogue-AP detection. On-site locally, or remotely anywhere in Australia.
Book a wireless security audit → or call 1300 644 588
