Protocol analysis for a transit-yard WLAN shows unusual deauthentication spikes that correlate with sudden client drops. Which detection conclusion is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Lots of “get off my AP” frames right when laptops fall offline is the smoking gun for a deauth flood. Your wireless analyzer or WIPS is doing its job by tying the spike to the drops. DNS firewall rules do not invent 802.11 deauths.
Full Explanation
Protocol analysis for a transit-yard WLAN that shows unusual deauthentication spikes correlating with sudden client drops most appropriately supports the conclusion that wireless monitoring indicates a probable deauthentication flood or DoS pattern against stations. Correlation between deauth frame bursts and client drops is a hallmark of RF DoS affecting association stability for yard operations devices. Clients only roaming via 802.11r with no security relevance would not typically present as deauthentication spikes causing mass drops. The core firewall rate-limiting DNS does not appear as 802.11 deauth on the air. Captive-portal HTTPS certificate renewal without RF impact does not generate deauthentication floods. Transit yards with outdoor coverage and safety-adjacent tablets should treat such patterns as availability incidents until proven otherwise. Exam caveat: confirm with captures that spikes are deauth/disassoc management frames, then locate the source; do not assume every drop is benign roaming. Operational check: review packet captures or WIPS timelines for deauth floods, geolocate the transmitter around the yard, enable PMF where clients support it, restore client associations, and document operations impact for transit supervisors.