Does Windows 7 have built in wifi deauthentication attack protection?

Question

I'm testing a wifi de-authentication attack and it looks like my Windows 7 client is not getting kicked off the network during the deauthentication. Any explanations as to why that might be?

I've got Kali running aireplay-ng and tested both a directed and broadcast attack. During the broadcast, my XP client very clearly lost its connection.

Confirmed with a packet capture that the Windows 7 client is receiving the deauthentication management frames, although aireplay is getting almost no ack messages back.

I'd like to think either the W7 client is getting disconnected and the application layer just isn't showing the disconnection (the wifi icon in the system tray never drops off) or the system is reconnecting too fast for it to even register it was kicked off, although I doubt these are the case, especially since I can still get to the wifi router management webpage (its not connected to the internet so perhaps thats normal, and I wouldnt be able to connect to an outside webpage?). It's an unprotected network, so theres no .11w running. Is there something simple I'm missing here?

Answer 1

It shouldn't matter. The 802.11 de-authentication attack is not attacking the computer so the Operating System of the client should not matter. It is attacking the network itself by telling the router that the clients are done the connection and are disconnecting.

There are defences for de-authentication attacks but it is not based on the OS. It is basically making the client jump from 1 AP to another to avoid being disconnected.

Answer 2

Make sure you adjust the number of deauths to send.. android devices can get deauth after sending 3-18 consecutive deauth, Linux devices get deauth after 10-30 deauths. IDK with windows.. you gotta test it by yourself..

just add the "-0" that's a zero followed by [number of deauth attack]

Answer 3

Ran another test of my attack on a connection with outside internet access and then the first network again with no outside access, both with success. I'm not sure why the aireplay-ng didn't get results on the W7 machine, but it can definitely be disconnected. After a few seconds of running the hosts were all disconnected. Airodump-ng did not show the disconnection of the hosts though, and it took a long minute for the W7 host to show the disconnection, but even before the system tray icon showed the drop, I was unable to access any webpage. During the attack the hosts were able to briefly reconnect a couple times before getting stopped completely. One interesting note, after I stopped the program the hosts still could not reconnect until I reset the router and the host. My guess is the system was so overloaded from the deauth frames and it needed a hard reset to clear its queue of frames to process, but thats just a guess.