1️⃣DoS - Frame Flooding (Deauth, EAPOL, Beacons)
Last updated
Last updated
Management frames are a specific type of frame in a WiFi network that are used for the management and control of wireless communication. They play a crucial role in the functioning and organization of WiFi networks by facilitating tasks such as network discovery, authentication, association, and periodic communication between network devices.
Here are the main types of management frames in a WiFi network:
Beacon Frames: Beacon frames are broadcasted periodically by WiFi access points (APs) to announce their presence and provide information about the network, such as the SSID (network name), supported data rates, security settings, and other parameters. Devices use beacon frames to discover and connect to available networks.
Probe Request/Response Frames: When a WiFi device wants to find and connect to a specific network, it sends out probe request frames. These frames include the SSID of the network the device is looking for. Access points within range respond with probe response frames containing information about the network, allowing the device to decide which network to join.
Authentication Frames: Authentication frames are used in the process where a WiFi device authenticates itself with the network. There are two types of authentication frames:
Authentication Request: Sent by a WiFi device to request access to the network.
Authentication Response: Sent by the access point to confirm or deny the authentication request.
Association Frames: Once a device is authenticated, it sends an association request frame to request association with a specific AP. The AP responds with an association response frame to either accept or reject the association request. Upon successful association, the device can then communicate with the network.
Deauthentication Frames: Deauthentication frames are used to terminate a device's association with the network. They can be sent by either the access point or the device itself to signal the end of an authenticated session.
Management frames are essential for the proper functioning and organization of WiFi networks. They enable devices to discover networks, authenticate and associate with access points, and maintain connectivity. However, because they are fundamental to network management, management frames can also be targeted in various types of attacks, such as WiFi Frame Flooding attacks, which aim to disrupt network operations by overwhelming it with excessive management frame traffic.
A deauth or de-authentication attack disrupts connections between users and Wi-Fi access points. The attackers force devices to lose access and then reconnect to a network they control. Then, perpetrators can capture login details or trick users into installing rogue programs. Learn more about how de-authentication attacks work and how you can mitigate their impact.
Essentially, a de-authentication attack works through the following steps:
Some Wi-Fi networks do not have effective mechanisms for verifying MAC addresses.
Perpetrators spoof MAC addresses and send de-authentication frames, forcing the client offline.
If attackers continue sending forged frames after they terminate connections, users won’t be able to reconnect. While the attack could focus on a single target, it might also jam the wireless networks. Thus, all connected clients go offline.
Attackers can set up rogue networks or evil twins mimicking legitimate access points so they can watch victims’ traffic. This surveillance covers all communications, visited websites, and financial transactions.
هو ال frame المسؤول عن عملية ال authentication
هبعت عدد كبير من ال authentication requests ال radius server أو ال Access Point مش هيكون قادر إنه يتعامل مع العدد الكبير دهه وبالتالي أي حد بيحاول يتصل على الشبكه مش هيكون قادر على القيام بعملية الإتصال دي ودهه بيوصلنا لحجب الخدمه ال DOS عن كل ال clients
Example:
في عدد كبير جدا من الشبكات الي بتبعت Beacons ل Clients في الحالة دي مش هيقدروا يعملوا اتصال على أي شبكه لانه هيكون مش معروف اي شبكه هي الأصلية
