Forum

I believe that since the deauthenticate frame is a management frame it would not be protected and deauthentication would occur.

Thanks moe for the response, I recall that management and control frames are unencrypted. To further investigate this then....

What I am seeing, when I have clients connect to an AP with WEP, it (the WIPS) won't deauth the client after the client is associated and on the network surfing, etc.?

I have classified the client as unauthorized on the AP through use of distributed sensors. When the clients disconnect on their own then try to reconnect, it the WIPS won't let them, thus fulfulling the deauth job. Is this an anomoly that caches the authentication until the client disconnects, if so then the WIPS is faulty or ist it one of those "proprietary" things?

I am using WEP with a passphrase on the AP .