Deauth Attack + PMF · Guide
A meticulous technical examination of the 802.11 deauthentication attack vector and the precise countermeasure that neutralises it: Protected Management Frames (IEEE 802.11w), now mandatory under WPA3.
Get a free site survey Talk to a specialist
In short: This guide covers “WiFi Deauthentication Attacks & PMF Protection — Guide” for businesses in Abu Dhabi and Al Ain. It is written by Emirtech, an independent integrator. For a specific site, a survey or assessment comes first, then a written itemised quotation.
| Published by | Published by Emirtech Technology, an independent integrator in Mussafah, Abu Dhabi, in operation since 2018. |
|---|---|
| Where? | Abu Dhabi and Al Ain, served from Emirtech's Mussafah, Abu Dhabi base; there is no Al Ain office. In Dubai: smart home, PABX and IP-PBX phone systems, IT AMC and time attendance by scheduled on-site visits, gate barriers, ANPR, video intercoms and turnstiles by Emirtech itself; CCTV, alarm and access control through SIRA-approved partners, with Emirtech coordinating. |
| Survey and quotation | Emirtech publishes no price list: it surveys or assesses first and then gives a written, itemised quotation. |
| Credentials | Emirtech is an independent systems integrator. It holds no manufacturer-level credential of its own, and its ADMCC approval covers security systems only, not IT services. |
| Last reviewed | 21 October 2026 |
A WiFi deauthentication attack exploits a fundamental design weakness in the original IEEE 802.11 specification: management frames — including deauthentication (subtype 0x0C) and disassociation (subtype 0x0A) frames — are transmitted in cleartext with no cryptographic authentication. Any device within radio range can craft a spoofed deauthentication frame bearing the access point's BSSID as the source address and the broadcast address (FF:FF:FF:FF:FF:FF) or a specific client MAC as the destination, compelling every associated station to disconnect immediately. The client's 802.11 state machine transitions from State 3 (authenticated and associated) back to State 1 (unauthenticated and unassociated), severing the connection without any verification that the frame originated from the legitimate AP. Tools such as aireplay-ng, mdk3, and mdk4 automate this process, transmitting hundreds of forged deauth frames per second with minimal hardware — a commodity USB adapter supporting monitor mode and frame injection is sufficient. Attackers weaponise deauthentication for three distinct objectives: denial of service, where continuous deauth floods render an entire SSID unusable; evil-twin facilitation, where clients are forced off the legitimate AP and steered toward a rogue access point broadcasting the same SSID, enabling man-in-the-middle interception and credential harvesting; and WPA handshake capture, where the forced re-association generates a fresh EAPOL 4-way handshake that the attacker captures for offline dictionary or brute-force cracking. The definitive countermeasure is Protected Management Frames (PMF), standardised as IEEE 802.11w-2009 and later incorporated into the base 802.11-2012 revision. PMF extends the protections of the pairwise transient key (PTK) and the integrity group temporal key (IGTK) to unicast and broadcast management frames respectively. Broadcast and multicast management frames from the AP, including deauthentication and disassociation, are authenticated using the Broadcast Integrity Protocol (BIP-CMAC-128 or BIP-GMAC-256), and unicast management frames between AP and client are encrypted with AES-CCMP or GCMP, the same cipher suite protecting data frames. A client with PMF negotiated will silently discard any management frame that fails integrity verification, rendering forged deauth frames ineffective. Under WPA3-Personal (SAE) and WPA3-Enterprise, PMF is mandatory — the Management Frame Protection Capable (MFPC) and Management Frame Protection Required (MFPR) bits are both set in the RSN Information Element. Under WPA2, PMF remains optional and must be explicitly enabled by the administrator; the configuration field is typically labelled "802.11w" or "Management Frame Protection" and offers three states: disabled, optional (capable), or required. Emirtech Technology, ADMCC-approved for security systems and operational from M44, Mussafah Industrial Area, Abu Dhabi since 2018, configures PMF enforcement, validates association and authentication behaviour, and deploys WIDS/WIPS monitoring across enterprise wireless infrastructure. For a considered assessment of your network's exposure to deauthentication and management-frame attacks, contact our engineering team at +971 55 651 7843 or request a quotation.
Deauth Attack + PMF
Original 802.11 management frames carry no Message Integrity Check or encryption. Deauthentication and disassociation frames are accepted at face value by the client's state machine, regardless of origin — any device in radio range can forge them with a spoofed BSSID.
Forged deauth frames serve three attack modes: sustained denial of service that renders an SSID inoperable, evil-twin steering that redirects clients to a rogue AP for credential interception, and forced re-association that generates capturable EAPOL 4-way handshakes for offline key cracking.
IEEE 802.11w protects broadcast management frames with BIP-CMAC-128 using the Integrity Group Temporal Key (IGTK) and encrypts unicast management frames under AES-CCMP or GCMP using the existing pairwise transient key. Frames failing verification are silently discarded.
WPA3 sets both MFPC and MFPR bits in the RSN Information Element, making PMF non-negotiable. Every WPA3-Personal (SAE) and WPA3-Enterprise association requires protected management frames, closing the deauthentication vector by default at the protocol level.
Each item represents a deliberate, measured step in hardening your wireless infrastructure against management-frame attacks. Emirtech engineers can apply this checklist to an enterprise WiFi security engagement in Abu Dhabi. Call +971 55 651 7843 or visit our quotation page to schedule a review.
Detection + Defence
Wireless Intrusion Detection and Prevention Systems analyse management-frame patterns in real time. A deauth flood generates anomalous frame counts — exceeding hundreds per second from a single source — triggering alerts and optional automatic rogue-AP containment.
WPA3-Enterprise with 802.1X and EAP-TLS binds each client to a certificate-validated session. Even if a deauth frame bypasses PMF on a transitional SSID, the attacker cannot replicate the server certificate or complete mutual authentication on a rogue AP.
Devices incapable of 802.11w negotiation — certain IoT sensors, legacy barcode scanners, medical telemetry — are isolated onto a dedicated SSID and VLAN with restricted forwarding rules, limiting the blast radius of any successful deauthentication.
Periodic packet captures on monitor-mode sensors validate that PMF is actively negotiated, IGTK rotation occurs on schedule, and no unprotected management frames leak from misconfigured SSIDs — a measured verification rather than an assumed posture.
Emirtech Technology operates with precise boundaries. The following statements define our remit in WiFi security configuration, including PMF deployment and deauthentication mitigation, with the directness that a considered engagement warrants.
This deliberate delineation ensures that every engagement proceeds without ambiguity. For a considered discussion of PMF deployment and deauthentication hardening across your wireless estate, contact Emirtech at +971 55 651 7843 or submit a request through our quotation page.
Common questions
The original IEEE 802.11 standard (1997) designed management frames for simplicity and interoperability, not security. Deauthentication frames (subtype 0x0C) carry only the source BSSID, destination MAC, and a reason code — no authentication field, no MIC, no sequence-number binding. The receiving client's state machine processes the frame unconditionally. Since management frames are transmitted outside the encrypted data channel (before or independent of the pairwise key), any radio in monitor mode with injection capability can construct a valid-looking deauth frame. This was a deliberate design trade-off in 1997 that became a critical vulnerability as WiFi moved from research labs to production infrastructure. IEEE 802.11w (2009) retroactively addressed this by extending integrity protection to management frames.
When PMF is negotiated during the 4-way handshake, the AP and client establish an Integrity Group Temporal Key (IGTK) alongside the standard GTK. Broadcast management frames — including deauthentication and disassociation sent to FF:FF:FF:FF:FF:FF — are protected with the Broadcast Integrity Protocol (BIP), which appends a Management MIC Information Element (MMIE) containing a CMAC-128 or GMAC-256 tag computed over the frame body using the IGTK. Unicast management frames are encrypted with AES-CCMP or GCMP under the pairwise transient key (PTK), identical to data-frame protection. When a client with an active PMF security association receives a deauthentication frame, it verifies the MMIE tag against the current IGTK. A forged frame, lacking the correct IGTK, produces an invalid tag and is silently discarded — the client remains associated.
When PMF is configured as Required (MFPR=1 in the RSN Information Element), the AP will reject association requests from any client that does not set the MFPC bit in its own RSN IE. The client receives an Association Response with status code 31 (Robust Management Frame Policy Violation) and cannot connect. This is by design — allowing unprotected clients would create a mixed-security SSID where the attacker simply targets the unprotected stations. The correct architectural response is to provision a separate SSID with PMF set to Optional or Disabled, mapped to a restricted VLAN with tighter wired-side ACLs, specifically for legacy devices. Gradually retiring non-802.11w hardware remains the measured long-term strategy.
WIDS (Wireless Intrusion Detection System) sensors operating in dedicated monitor mode can detect deauthentication floods by analysing frame-rate anomalies — a legitimate AP rarely sends more than a handful of deauth frames per minute, whereas an attack generates hundreds per second from a consistent source MAC. Systems such as Aruba RFProtect, Cisco Adaptive wIPS, and Meraki Air Marshal correlate these patterns and generate alerts with source localisation. WIPS (Prevention) can go further by transmitting containment frames against a detected rogue AP. However, WIDS/WIPS without PMF is a detection-and-response layer, not a prevention-at-the-protocol layer — the deauth frames still reach and disconnect clients before the alert fires. PMF prevents the disconnection itself at the client's state machine. The two are complementary: PMF neutralises the frame, WIDS/WIPS detects the attempt and identifies the attacker's physical location.
PMF protects the authenticated management frames exchanged after association — deauthentication, disassociation, and action frames. It does not protect pre-association frames such as Beacon, Probe Request, Probe Response, and Authentication frames, because no security association yet exists. An attacker can still conduct Beacon spoofing, probe-response injection, or authentication-frame flooding. Additionally, PMF does not protect against RF-layer denial of service (broadband jamming) or attacks targeting the control plane at higher layers. A comprehensive posture combines PMF with WPA3-Enterprise (802.1X/EAP-TLS for mutual authentication), WIDS/WIPS for anomaly detection, proper channel planning to reduce exposure, and physical-security measures to restrict attacker proximity. PMF is necessary but not independently sufficient for complete management-frame security.
Contact Emirtech Technology at +971 55 651 7843 (call or WhatsApp) or email [email protected] to schedule an initial consultation. Alternatively, submit your requirements through our quotation page for a structured response. Our engineers assess your current SSID security configuration, PMF negotiation status, client 802.11w compatibility, and WIDS/WIPS coverage, then deliver a documented hardening plan with implementation. Engagements cover Abu Dhabi Emirate including Al Ain, from our base at M44, Mussafah Industrial Area.
Deauth Attack + PMF · Guide
Free site survey · transparent scope · honest costs · ADMCC-approved for security systems · Mussafah M44 home base since 2018.
Need a free Abu Dhabi site visit? Call +971 55 651 7843 or email [email protected] — we reply the same working day across Abu Dhabi and Al Ain.