AirMagnet PRG-Laptop 7.0, Reference Manual, Page: 53 / 210

AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 2: IDS—Denial of Service Attack 45
IEEE 802.11 defines a client state machine for tracking station
authentication and association status. Wireless clients and APs
implement such a state machine (illustrated below) according to the
IEEE standard. A successfully associated client station stays in State 3
in order to continue wireless communication. Client station in State 1
and State 2 can not participate in WLAN data communication until it
is authenticated and associated to State 3 .
Figure 2-16: Attacker spoofs 802.11 de-authentication frames from AP
to client station to bring client to state 1
A form of DoS attack aims to send a client of an AP to the
unassociated/unauthenticated State 1 by spoofing de-authentication
frames from the AP to the client unicast address. With today's client
adapter implementations, this form of attack is very effective and
immediate in terms of disrupting wireless services against the client.
Typically, client stations would re-associate and re-authenticate to
regain service until the attacker sends another de-authentication
frame. An attacker would repeatedly spoof the de-authentication
frames to keep all clients out of service.
Laptop Wireless LAN Policy Reference Guide.book Page 45 Thursday, January 25, 2007 5:36 PM