In fake authentication attacks, there are two types of WEP authentication (Open System and Shared Key) you can only do fake authentication for WEP enabled AP. This useful when you need an associated MAC address in various aireplay-ng for example in WEP cracking attack when there is no associated client.
It should be noted that the fake authentication attack does NOT generate any ARP packets
How it works:
- It sends an Authentication Request
- It gets Authentication Reply, if successful it would send (3)
- It gets an Association request
- Association response it will make it successful
ARP-Replay attack is when an ARP packet is re-transmitted back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV.
When this is complete and successful you can know do the Arp-replay attack so you can generate more ARP packets so that the IV can be revealed. This works because for an AP to answer to an ARP packet it has to have the MAC address of the wireless card that is doing that is replaying the captured ARP. That is why we do fake authentication.
To prevent this i only know of one way which is to stop using WEP and use WPA and WAP2. Because remember Fake authentication only works with WEP enabled AP.