Defending a Wireless Network

You just spent four lessons breaking Wi-Fi. Now flip sides, because the defenses map cleanly onto the attacks and most of them are free. The single highest-value move against everything in this module is WPA3, and the reason it matters is specific: it kills the offline crack.

WPA3 breaks the offline attack

WPA2-Personal fails because the handshake leaks enough to guess passwords offline forever. WPA3-Personal replaces that handshake with SAE (Simultaneous Authentication of Equals), also called Dragonfly. SAE never transmits anything that lets an eavesdropper verify a password guess offline. Capture the exchange all you want, there is no MIC-style value you can grind a wordlist against on your own hardware.

SAE also enforces guesses online, against the live AP, one attempt per handshake. That turns billions of GPU guesses per second into a handful of tries against a device you can rate-limit and alarm on. A weak WPA3 passphrase is still weak, but the attacker has to knock on the actual door for every guess, and you will see them knocking.

If your gear supports it, run WPA3, or WPA3/WPA2 mixed ("transition") mode if you still have legacy clients. Understand the tradeoff: transition mode keeps a WPA2 handshake on the air for old devices, so it keeps the crack alive too. Pure WPA3 is the real fix. Check what a client actually negotiated:

Segment the network

WPA3 protects the front door. Segmentation contains the damage if anything gets past it. Put untrusted and chatty devices on their own network so a compromise of one does not reach the rest.

Three separate SSIDs or VLANs is a sane baseline: one for trusted computers and phones, one for IoT (cameras, smart plugs, the TV) that talks only to the internet and not to your laptops, and one guest network isolated from both. Most consumer routers do guest isolation with a checkbox. IoT segmentation usually means a second SSID or a VLAN on prosumer gear.

The point is blast radius. A camera with a hardcoded password on the IoT network cannot pivot to your file server if the two networks cannot route to each other. Enable client isolation on guest and IoT so associated devices cannot even see each other.

Watch for rogue APs and deauth floods

The evil twin and the deauth attack both leave signatures in the air, and you have the same tools the attacker does. Scan your own space and know what a legitimate baseline looks like.

Two BSSIDs advertising your SSID means someone cloned your network. A continuous burst of deauth frames aimed at your clients is the lure phase of an evil twin or a plain denial of service. On managed enterprise gear this is a built-in feature called a Wireless Intrusion Prevention System (WIPS); at home you run the scan yourself when something feels off.