A deauthentication attack is a Wi-Fi disruption technique that forges 802.11 disconnect frames to make a client believe it has been removed from a network. Because older Wi-Fi protections did not always authenticate management traffic, an attacker within radio range could send fake deauth or disassociation messages and repeatedly kick devices off the access point.
This matters because forced disconnects can create denial of service, interrupt remote work, and push users toward a rogue access point or “evil twin” network that looks legitimate. In practice, attackers may combine deauthentication with SSID spoofing and a captive portal to harvest credentials or steer traffic through a malicious device. Defenses include Protected Management Frames (802.11w/PMF), strong WPA2/WPA3 configurations, rogue AP detection, and monitoring for unusual association churn. If the symptom looks like broad wireless instability rather than targeted Wi-Fi-layer abuse, spectrum analysis can help distinguish deauth traffic from radio-frequency interference.