In a WLAN network, Spoof spoofing attack packets mainly include which of the following two types of packets? (Multiple choice)

Question

Options

• ABroadcast type disassociation frame Disassociation
• BBroadcast type deauthentication frame Deauthentication
• CUnicast disassociation frame Disassociation
• DUnicast deauthentication frame Deauthentication

• A
  71% (12)
• C
  24% (4)
• D
  6% (1)

Explanation

In WLAN spoofing attacks, attackers forge management frames using the AP's MAC address to forcibly disconnect clients. Broadcast disassociation (A) and deauthentication (B) frames are the primary weapons because a single spoofed broadcast packet (sent to FF:FF:FF:FF:FF:FF) simultaneously disconnects all associated clients - maximizing disruption with minimal effort and without the attacker needing to know any individual client's MAC address.

Why C and D are wrong: Unicast disassociation and deauthentication frames target a single known client MAC. While technically possible in a targeted attack, they are not the defining characteristic of a spoof-based mass-disconnection attack - they require per-client knowledge and are far less efficient for causing widespread network disruption.

Memory tip: Think "Broadcast = Bang" - spoof attacks go broadcast because one forged frame takes down the whole crowd. If you see "broadcast" + management frame (Deauth or Disassoc), that's your answer for WLAN spoofing/flooding attacks.

No community discussion yet for this question.