Wireless networks introduce their own set of threats that don't exist on wired infrastructure. An evil twin attack sets up a rogue Wi-Fi access point that mimics a legitimate one in name and signal, luring users to connect so that their credentials can be captured. A deauthentication attack sends forged Wi-Fi deauthentication frames to disconnect clients from a real AP, often as a step toward capturing the WPA handshake for offline cracking. Defending against these requires strong protocol design, which is why Wi-Fi security has evolved through successive generations: WEP used broken RC4 and is now obsolete; WPA was a transitional protocol using TKIP; WPA2 introduced AES-CCMP and was the long-running standard; and WPA3 replaces the PSK four-way handshake with Simultaneous Authentication of Equals (SAE), providing forward secrecy and resistance to offline dictionary attacks. Many public and guest networks also use a captive portal, a web page users must interact with—typically accepting terms or logging in—before gaining network access, which both controls access and shapes user expectations.
Denial of service attacks target availability rather than confidentiality. A DoS attack overwhelms a target with traffic or requests from a single source, while a Distributed Denial of Service (DDoS) attack uses many distributed sources—typically a botnet of compromised machines—to generate traffic. Because DDoS traffic comes from many legitimate-looking endpoints distributed across the Internet, it is much harder to filter than a single-source DoS attack. Mitigation generally involves a combination of upstream scrubbing services, rate limiting, and resilient architecture designed to absorb large volumes of traffic without becoming unreachable.
Wireless and denial-of-service defenses overlap in practice: segmented guest networks backed by captive portals isolate untrusted clients from internal resources, while rate limiting at the access point and on upstream links mitigates both isolated DoS attempts and botnet-driven DDoS traffic. Choosing WPA3 where supported closes the door on common Wi-Fi handshake captures, and maintaining client-side protections such as certificate validation prevents users from being silently redirected to evil twins.