Simple definition
PMF (Protected Management Frames), introduced by 802.11w, protects selected Wi-Fi management frames against spoofing and deauthentication or disassociation attacks.
Technical definition
PMF adds cryptographic protection to robust management frames after Wi-Fi security has been established. It is required by some modern security modes such as WPA3 and can be configured as capable/optional or required depending on the access point.
How it works / role
Once the client is associated and keys are established, protected management frames are authenticated. A forged frame without valid protection is rejected, reducing attacks that try to disconnect a client by sending fake management frames.
What is it used for?
Make a WLAN more resistant to spoofed management traffic, especially forged deauthentication and disassociation frames.
Practical example
A WPA3 SSID requires PMF. An attacker transmits fake deauthentication frames, but compatible clients ignore them because the expected cryptographic protection is missing.
Common issues
- Legacy client does not support PMF required
- Outdated Wi-Fi driver or chipset-specific behavior
- Required mode is enabled on a mixed client population
- PMF is confused with encryption of user data
Key takeaway: PMF protects specific management frames; its configuration must match client capabilities and the WPA security mode in use.