Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted:

Weak PSK passphrases can be broken using off-line dictionary attacks by capturing the messages in the four-way exchange when the client reconnects after being deauthenticated.

Why is it not possible to protect against wlan deauthentication flooding. I understand that unencrypted managment frames are part of the standard, but why the hack is this necessary??? Especially for something as critical as a deauthentication packet? I asume there are some crytographic reasons for this, but I have no concrete idea, which is why I am asking. It would be great if anyone would know an answer.

  • This was later fixed with Protected Management Frames also known as 802.11w though with enough interference a client will think it's disconnected and try and reconnect so this is only a partial solution. Some security fixes are reactive to weaknesses in the original system, I suppose this was one. Commented Apr 20, 2016 at 19:33

3 Answers 3


Authentication and de-authentication is written into the protocol at a lower level than the encryption. It is the same regardless of whether you use WEP, WPA, or nothing at all.

The risk here is denial of service. A lot of de-auths can mean a lot of re-auths and that can chew things up. Properly implemented and using a good key, the encryption should not be at risk regardless of how many times the encryption is setup.

De-authing is a convenience for the attacker, but it is reasonable to assume that in a 24 hour period somebody will authenticate. If your attacker is interested in something beyond easy internet access, they'll get it.

This isn't the only case you'll find like this. SSL on TCP/IP has the same vulnerability -- the TCP flags, including the RST flag, are plaintext. How else do you tell somebody to end a connection if your system gets out of sync with their system?


Like many vulnerabilities in history this one might too be caused by some sort of uncreativity. The designers did not imagine an attack from this side.

Unfortunately the damage is done and you can't upgrade the handling of those packets without breaking compatibility with old clients. Older clients simply would not be able to issue a disconnect any more.


It is because the management frames are required in the preauth state. And these are the same management frames used when a network is opened (no auth needed). So basicaly you should think of the whole authentication thing level higher making encrypted connection with authentication.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .