offensive-deauth-disassoc

Use aireplay-ng with the --deauth flag targeting the AP BSSID and client MAC on a monitor-mode interface. A burst of 3-10 deauth frames forces the client to reconnect, letting you capture the four-way handshake with airodump-ng.

aireplay-ng handles precise single-client or broadcast deauth bursts, while mdk4 provides multi-tool attacks including beacon flooding, authentication floods, and SAE floods. mdk4 suits DoS and WIPS stress scenarios; aireplay-ng suits quiet handshake capture.

No, PMF cryptographically authenticates deauth and disassoc frames, so classic deauth is ignored when PMF is required. Pivot to action-frame attacks such as mdk4 authentication floods or CTS frame abuse, which PMF does not always protect.

Run airodump-ng locked to the target channel and BSSID and inspect the PMF column in the beacon RSN capabilities. It shows Required, Capable, or Off, which determines whether classic deauth will succeed.

Continuous broadcast deauth produces a clear DoS signature that most WIPS platforms flag within seconds. Bursts over 30 deauths per second from one source trip WIPS rules, so single-client bursts of 3-10 frames are far quieter.

Avoid broadcast deauth without explicit written authorization, since it denies service to all clients on the AP. It is also counterproductive for stealthy handshake capture, where targeted single-client deauth is the preferred approach.