During a civic-center incident review, analysts see bursts of deauthentication frames that force laptops to reconnect while a nearby adversary captures handshakes. What is the best characterization of this technique?
Select an answer to reveal the explanation.
Short Explanation
Deauths are like yanking the power cord so the laptop has to plug back in—while someone watches the reconnect. The kick itself hurts availability and often sets up handshake capture or evil-twin bait. It is not a friendly site survey.
Full Explanation
During a civic-center incident review, bursts of deauthentication frames that force laptops to reconnect while a nearby adversary captures handshakes are best characterized as a denial-of-service style deauth that disrupts clients and often enables follow-on eavesdropping or evil-twin attacks. Deauth floods degrade availability and create convenient windows to capture WPA handshakes or push users toward a twin. A vendor-supported RF planning survey using only inactive scanning does not inject deauthentication bursts. Harmless DHCP INFORM messages used for captive-portal refresh are wired/client DHCP behavior, not 802.11 deauth. An FT over-the-DS roam that always strengthens PMKSA caching is a roaming optimization narrative that does not describe malicious deauth plus handshake capture. Civic incident handlers should treat correlated deauth spikes and handshake capture tooling as an active wireless attack pattern. Exam caveat: protected management frames reduce unprotected deauth effectiveness where supported, but detection and response still matter for mixed client estates. Operational check: confirm deauth signatures in WIPS or packet captures, locate the transmitter, enable PMF where feasible, rotate PSKs if Personal SSIDs were targeted, and document availability impact for civic-center stakeholders.