Deauthentication
Deauthentication Type: 00 Subtype: 1100 Deauthentication frames are different from Disassociation frames as they will force a client to completely renegotiate the connection/ reset the 802.11 state machine. Deauthenticating a client can sometimes be useful in troubleshooting if you need to recreate a problem as the client will start the connection from scratch, allowing you to capture all frames from the beginning of the conversation. Deauthentication frames can be sent broadcast or unicast from the AP or unicast by a client. The client's ability to send deauthentication frames means it is important to use protected management frames, so users on your network do not become victims of a deauthentication attack from a spoofed sender. Below is a deauthentication frame from a packet capture: There's not much to it. Note the reason code, there are reason codes 0-39 that will define why a client was deauthenticated. A ...