Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network.

I captured and analyzed the network traffic on my Wifi work network, and I noticed a remarkable amount of 802.11 deauth packets. I realize it may not be possible to catch him, or even know where the attack came from. I just want to know: Is there any way to prevent such an attack?

share|improve this question
Like @gowenfawr stated, there is no practical technical means to stop such an attack. Your best bet would be to report to local law enforcement and let the law try to deter him. – Terry Chia Sep 15 '12 at 2:47
up vote 17 down vote accepted

Realistically, you cannot stop a bad guy from sending deauthentication packets.

Instead, you should focus on ensuring you are resilient to a deauth attack. Make sure your network is configured in a way that the deauth attack doesn't enable an attacker to compromise your network.

To do that, you need to make sure you are using WPA2. If you are using a pre-shared key (a passphrase), make sure the passphrase is very long and strong. If it is not already, change it immediately! If you are not using WPA2, fix that immediately!

The primary reason why bad guys send deauth packets is that this helps them execute a dictionary attack against your passphrase. If a bad guy captures a copy of the initial handshake, they can try out various guesses at your passphrase and test whether they are correct. Sending a deauth packet forces the targeted device to disconnect and reconnect, allowing an eavesdropper to capture a copy of the initial handshake. Therefore, standard practice of many attackers who might try to attack your wireless network is to send deauth packets. If you are seeing many deauth packets, that is a sign that someone may be trying to attack your wireless network and guess your passphrase.

Once the attacker has sent a deauth packet and intercepted the initial handshake, there are tools and online services that automate the task of trying to recover the passphrase, by guessing many possibilities. (See, e.g., CloudCracker for a representative example.)

The defense against this kind of attack is to ensure your passphrase is so long and strong that it cannot possibly be guessed. If it's not already long and strong, you need to change it right away, because someone is probably trying to guess it as we speak.

(The other reason a bad guy might send deauth packets is as an annoyance. However, as most users probably won't even notice, it's not a very effective annoyance.)

To learn more, see these resources:

share|improve this answer
You indicated it's not a very effective annoyance, but this GitHub repo indicates it can effectively knock everyone off the Wifi network when scripted: -- Call me crazy, but that sounds mighty annoying. Am I missing something? – Dan Esparza Apr 18 '14 at 13:37
@DanEsparza, you might be right. I had the impression clients would automatically re-connect, but I could be wrong: I haven't tested it. If you found documentation that says it kicks clients off the network and they staff off, I believe you. – D.W. Apr 18 '14 at 15:50
Actually -- I don't know it's that they stay off the network automatically, it's just that the attack can be scripted in such a way that clients are too busy 'constantly re-authenticating' to do anything useful. – Dan Esparza Apr 18 '14 at 18:21
If I do not use WPA/WEP at all but an open access point with mandatory VPN or IPSec encryption. Can I get a DeAuth-proof WiFi with no loss on security? – 比尔盖子 Oct 23 '15 at 13:56
@比尔盖子, no. The VPN will ensure confidentiality+integrity, but if that's the route you're considering, it'd be better to use WPA plus your VPN/IPSec. – D.W. Oct 23 '15 at 15:17

The only way to prevent such an attack is to block the attacker's ability to send wireless transmissions that will reach your legitimate users. That's not a practical solution for several reasons (but extra points if you can convince your workers to sit in a Faraday Cage).

This blog page here quotes some of the relevant WiFi standard, most pointedly:

Deauthentication is not a request; it is a notification. Deauthentication shall not be refused by either party.

So, no, there's no real way to prevent such an attack.

share|improve this answer
+1 for the (Faraday Cage), really like it ;) – sarepta Sep 14 '12 at 22:25
Bummer - that URL is dead and not archived on any of the major sites. Your answer implies that one has to follow the relevant standard. But it's just a document. We are free to ignore it. There are consequences, but surely it's not illegal, and I'm wondering what, practically speaking, would go wrong IRL if all implementations ignored all de-auth packets. – Matthew Elvey Mar 30 at 19:46
@MatthewElvey, about the same thing as if all car drivers ignored stop signs. The network would jam up with talkers talking and their packets crashing against cards that won't listen (the deauth sender is never going to listen to that convo again). – gowenfawr Apr 5 at 22:57
@gowenfawr You're referring to Collision avoidance but deauthentication packets aren't even mentioned among the many methods (prior scheduling of timeslots, carrier-detection schemes, randomized access times, and exponential backoff after collision detection) mentioned there. So I see a jam as unlikely. From what I can tell, deauthentication packets are for stuff like an incorrect message integrity checking (MIC) value is detected, or for an access point orderly shutdown. – Matthew Elvey Apr 22 at 21:34

Cisco did spearhead a method of detecting these attacks and even protecting this type of attack if it is enabled and the client device supports it (minimum support of CCXv5). The Cisco feature is called "Management Frame Protection" and full details can be found on the Cisco website.

In essence, the process adds a hash value to all management frames that are sent.

This process was standardized with the IEEE 802.11w ammendment released in 2011, and is supported by most modern Linux/BSD distributions in the kernel. Windows 8 was introduced with 802.11w support by default (which did cause some initial problems in some environments). AFAIK, OSX still lacks 802.11w support.

For reference, 802.11w was rolled up in the 802.11-2012 maintenance release of the 802.11 standard.

share|improve this answer
This is the correct answer, long term. Especially in light of recent news about hotel chains blocking Wi-Fi. Apple needs to implement, and AP makers need to enable, protected management frames in order to secure the Wi-Fi MAC. – alfwatt Jan 17 '15 at 3:29

Current 802.11 standard defines "frame" types for use in management and control of wireless links. IEEE 802.11w is the Protected Management Frames standard for the IEEE 802.11 family of standards. TGw is working on improving the IEEE 802.11 Medium Access Control layer. The objective of this is to increase the security by providing data confidentiality of management frames, mechanisms that enable data integrity, data origin authenticity, and replay protection.


looks like protection against deauth and replay is already in bsd/linux kernel:

The 802.11w standard is implemented in Linux and BSD's as part of the 80211mac driver code base which is used by several wireless driver interfaces i.e ath9k. The feature is easily enabled in most recent kernels and Linux OS's using these combinations. Openwrt in particular provides an easy toggle as part of the base distribution.

share|improve this answer

If possible, get everyone to connect to a wired network for a week, and shut off your wifi. After a week, turn it back on and hopefully the attacker will have given up by then. I would also try to whitelist everyone on your network so only those IPs can connect. If you suspect they are going to continue attacking you regardless of the effort it will cause them, then I agree with Terry, contact the local law enforcement and let them handle it.

share|improve this answer
White listing would have no effect on the type of attack described by the OP. The attacker spoofs the L2 identity of the AP or client and would be allowed by the white list entry. Further, since it is a L2 attack, IP addresses are not used. – YLearn Aug 1 '14 at 4:13

protected by Rory Alsop Nov 3 '14 at 11:01

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.