Method and system for DOS detection, mitigation and notification

1. A method for processing a denial of service (DOS) attack in a wireless local access network (WLAN), the method comprising:

in response to receiving a de-authentication/disassociation (D/D) frame by an access point (AP):

determining, by the AP, a state of security association establishment between the AP and a client device;

maintaining a connection between the AP and the client device if the security association is incomplete; and

sending a probe packet from the AP to the client device if security association is complete and the connection between the AP and the client device is in a non-PMF (protected management frames) setting wherein the connection is:

maintained if the client device responds to the probe packet; and

terminated if the client device does not respond to the probe packet.

2. The method of claim 1 , wherein maintaining the connection between the AP and the client device while the security association is incomplete comprises:

not processing the D/D frames received by the AP.

3. The method of claim 2 , wherein the frames received by the AP are sent from a client device or a spoofing device.

4. The method of claim 2 , further comprising:

sending a next security association frame to the client device.

5. The method of claim 1 , wherein maintaining the connection if the client device responds to the probe packet further comprises:

setting an under attack flag (UAF).

6. The method of claim 5 , further comprising:

notifying a network administrator of the UAF being set.

7. The method of claim 5 , further comprising:

notifying other software layers within the network of the UAF being set.

8. The method of claim 7 , wherein the other software layers involve at least one of:

configuration of the network, station management and AP monitoring.

9. The method of claim 5 , further comprising:

incrementing a counter for a number of received D/D frames.

10. The method of claim 5 , further comprising:

determining the state of security association establishment between the AP and a client device if the under attack flag is not set.

11. A non-transitory computer readable storage medium storing instructions that when executed by a processor of a network device, causes the processor to:

in response to reception of a de-authentication/disassociation (D/D) frame:

determine a state of security association establishment between the network device and a client device connected to the network device;

maintain a connection between the network device and a client device if the security association is incomplete;

send a probe packet to the client device if security association is complete and the connection between the network device and the client device is in a non-PMF (protected management frames) setting;

maintain the connection if the client device responds to the probe packet; and

terminate the connection if the client device does not respond to the probe packet.

12. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the processor to:

not process the received frame if the security association is incomplete.

13. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the processor to:

send a next security association frame to the client device if the security association establishment is incomplete.

14. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the processor to:

process the received frame if the client device does not respond to the probe packet.

15. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the processor to:

decrypt the received frame.

16. The non-transitory computer readable storage medium of claim 11 , wherein the instructions further cause the processor to:

set an under attack flag if the client responds to the probe packet.

17. A network device comprising a processor configured to:

in response to reception of a de-authentication/disassociation (D/D) frame:

determine a state of security association establishment between the network device and a client device connected to the network device;

maintain the connection if the security association is incomplete;

send a probe packet to the client device if security association is complete and the connection between the network device and the client device is in a non-PMF (protected management frames) setting;

maintain the connection if the client device responds to the probe packet; and

terminate the connection if the client device does not respond to the probe packet.

18. The network device of claim 17 , wherein the processor:

sets an under attack flag if the client responds to the probe packet.

19. The network device of claim 18 , wherein the processor:

increments a counter representing a number of received D/D frames.

20. The network device of claim 17 , wherein the processor:

sends a Request To Send (RTS) as the probe packet.