DoS: Disassociation Flood Attack

WiFi Manager raises this alarm when it gets an indication that there is a possibility of DoS attack by flooding the WLAN with disassociation packets.

How does the attack work ?

• The attacker initially identifies the targets (wireless clients) and their association (Access point to which it is associated).
• Injects disassociation frames into the WLAN by spoofing the source and destination MAC to that of the Access point and wireless client respectively.
• The wireless client upon reception of the frames disassociate themselves from the Access point, thinking that the packets have come from the Access point.
• After disrupting an wireless client of the wireless service, the attacker would continue the same with the other wireless clients in the WLAN to keep them all out of the WLAN.
• Typically the wireless clients will re-associate themselves to regain service, but this will be short lived as the attacker will be continuously sending the disassociation packets.

What can the WLAN Administrator do ?

The best bet would be to monitor the wireless LAN and particularly the associations pattern in the WLAN. If there are too many association requests and lot of short lived sessions then it is better to analyze and find out the reason for the same. WiFi Manager when deployed, does this automatically and keeps the administrator warned of potential problems. In case of attack, the administrator should identify the source which is generating all these disassociation packets and shut it down. WiFi Manager helps identifying the source of such problems.