AirMagnet PRG-Laptop 7.0, Reference Manual, Page: 35 / 210

AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 2: IDS—Denial of Service Attack 27
Figure 2-2: Spoofed 802.11 authentication requests flooding AP
association table, with clients stuck in state 1 and state 2
A form of DoS attack aims to flood the AP's client state table
(association table) by emulating many client stations (MAC address
spoofing) sending authentication requests to the AP. Upon reception
of each individual authentication request, the target AP would create
a client entry in state 1 in the association table. If Open System
authentication is used on the AP, the AP would send back an
authentication success frame and move the client to state 2 . If
Shared-key authentication is used on the AP, the AP would send an
authentication challenge to the attacker's emulated client, which
would not respond. In this case, the AP keeps the client in state 1 . In
either case, the AP ends up with many clients dangling in either state
1 or state 2, filling up the AP association table. When the table reaches
its limit, legitimate clients will not be able to authenticate and
associate with this AP, thus DoS attack is committed.
Attack tool: Void11
Laptop Wireless LAN Policy Reference Guide.book Page 27 Thursday, January 25, 2007 5:36 PM