The newly disclosed AirSnitch attack suite demonstrates that Wi‑Fi client isolation, a feature widely advertised by vendors to protect guest and open networks, often does not work as intended. Tests on consumer and enterprise devices from Netgear, D-Link, Ubiquiti, Cisco, TP-Link, Asus, and hardware running DD‑WRT and OpenWrt show that attackers can intercept and modify traffic from other clients while remaining inside the same wireless infrastructure.
AirSnitch: From Breaking Crypto to Exploiting the Wi‑Fi Network Stack
Developed by Xin’an Zhou and Mathy Vanhoef and presented at the Network and Distributed System Security Symposium (NDSS) 2026, AirSnitch differs fundamentally from earlier Wi‑Fi attacks such as KRACK. Whereas KRACK exploited weaknesses in the WPA2 cryptographic handshake, AirSnitch does not break WPA2/WPA3 encryption. Instead, it abuses subtle interactions between the physical and data link layers (Layer 1 and Layer 2) and the higher layers of the network stack.
The primary goal of AirSnitch is to bypass Wi‑Fi client isolation (also known as AP isolation). This mechanism is supposed to prevent devices on the same wireless network from communicating directly with each other, limiting lateral movement and local man‑in‑the‑middle (MitM) attacks. The research shows that, in practice, this protection can be circumvented without compromising WPA2/WPA3 keys.
The authors evaluated 11 widely used platforms, including the Netgear Nighthawk X6 R8000, D-Link DIR‑3040, TP‑Link Archer AXE75, Asus RT‑AX57, Ubiquiti AmpliFi Alien Router, Cisco Catalyst 9130, and OpenWrt 24.10. Every device tested was vulnerable to at least one AirSnitch variant. Some vendors have issued firmware updates, but several issues stem from architectural design choices that are difficult to fully address in software.
How AirSnitch Works: Port Stealing and Wireless Man‑in‑the‑Middle
Adapting Ethernet Port Stealing to Wi‑Fi Networks
At the core of AirSnitch is a wireless adaptation of a classic Ethernet technique known as port stealing. In a wired LAN, port stealing forces a Layer 2 switch to associate a victim’s MAC address with the attacker’s physical port, causing traffic destined for the victim to be forwarded to the attacker instead.
In the AirSnitch scenario, the access point (AP) and its wired backhaul effectively act as that Layer 2 switch. The attacker connects to the same BSSID as the victim but uses a different radio interface or band (for example, the victim on 5 GHz, the attacker on 2.4 GHz) and completes the standard WPA2/WPA3 four‑way handshake.
As a result, the Layer 2 forwarding logic starts sending frames intended for the victim to the attacker’s association, encrypting them with the attacker’s Pairwise Transient Key (PTK). As HD Moore of runZero highlights, this is possible because a wireless AP cannot strictly bind a “port” to a single client: all stations share the same RF medium and are expected to roam and switch bands.
Achieving Full Bidirectional MitM on WPA2/WPA3 Networks
To turn this one‑way interception into a full MitM channel, AirSnitch uses specially crafted ICMP echo requests (pings) with arbitrary spoofed MAC addresses, encrypted with the Group Temporal Key (GTK). These frames trigger the AP to refresh its internal MAC‑to‑port mappings while the victim’s traffic continues to flow through the attacker. The attacker can then transparently relay, inspect, and modify packets between the victim and the internet or internal services.
Crucially, the attacker does not need to be on the same SSID. The research shows that the attack can originate from another SSID or even a different VLAN, as long as they are bridged through the same distribution system behind the AP. In enterprise deployments, where multiple APs share a common wired infrastructure, this allows AirSnitch to scale beyond a single radio cell.
Security Impact: From HTTP Theft to Attacks on RADIUS
Exposing Unencrypted Traffic and Poisoning DNS
AirSnitch is particularly damaging wherever traffic remains unencrypted. According to Google’s HTTPS adoption statistics, around 6% of page loads on Windows and up to 20% on Linux are still performed over HTTP. In such cases, an attacker with MitM capabilities can read and alter cookies, session identifiers, credentials, personal information, and payment data in cleartext.
Even when websites use HTTPS, AirSnitch can still interfere with unprotected parts of the session. By intercepting and modifying traditional DNS queries, an attacker can perform DNS cache poisoning and silently redirect victims to phishing sites that visually mimic legitimate services. This is particularly dangerous when users ignore or do not see certificate warnings, or when attackers exploit mixed‑content and downgrade scenarios.
Bypassing Enterprise Isolation and Compromising RADIUS Secrets
The research confirms that AirSnitch is also effective against enterprise Wi‑Fi using WPA2‑Enterprise or WPA3‑Enterprise with unique credentials per user. Client‑specific authentication does not prevent attacks at the Layer 2 forwarding level.
One of the most severe scenarios involves spoofing the MAC address of the gateway or infrastructure components and intercepting RADIUS traffic between the AP and the authentication server. With a stable MitM position on this link, an attacker can observe and tamper with RADIUS messages, target the message‑authenticator attribute, and ultimately recover the shared RADIUS secret. Once the secret is known, the attacker can deploy a rogue RADIUS server and a malicious WPA2/WPA3 access point to harvest enterprise credentials at scale.
Mitigation: Limits of VPNs and VLANs and the Need for Zero Trust
Why VPNs and VLAN Segmentation Are Insufficient
Using a VPN provides only partial protection against AirSnitch. Many VPN implementations still leak metadata such as DNS queries, destination IP addresses, and Server Name Indication (SNI) fields outside the tunnel, allowing attackers to profile traffic and manipulate DNS. Split‑tunnel configurations can further expose sensitive flows to local interception.
Similarly, relying solely on VLAN segmentation between SSIDs is not a complete defense. VLAN topologies are prone to misconfiguration, and as security guidance from organizations such as NIST and the NSA notes, VLANs should not be treated as strong security boundaries. Because AirSnitch operates at the bridging layer, it can sometimes cross VLAN or SSID boundaries when they share the same distribution infrastructure.
Practical Recommendations for Home and Enterprise Wi‑Fi
A more resilient strategy is to adopt a Zero Trust model, where no device is implicitly trusted based on network location, and access is granted strictly on a least‑privilege, per‑session basis. Implementing Zero Trust, however, requires significant architectural and organizational changes and remains challenging even for mature enterprises.
In the near term, several pragmatic measures help reduce exposure to AirSnitch and similar attacks: migrate all services to HTTPS and enable HSTS; use secure DNS mechanisms such as DNS‑over‑HTTPS (DoH) or DNS‑over‑TLS (DoT); regularly update router and AP firmware; disable unnecessary SSIDs and guest networks; tightly restrict access to sensitive internal resources; and deploy wireless intrusion detection and monitoring capable of flagging anomalous MAC behavior or unusual band/SSID transitions.
Although AirSnitch requires an attacker to be within range of, and usually authenticated to, the target Wi‑Fi network—making it less scalable than fully remote exploits—it highlights structural weaknesses in how current Wi‑Fi infrastructures handle client isolation and Layer 2 forwarding. Until wireless architectures and implementations are redesigned with these findings in mind, organizations and home users should treat Wi‑Fi segments as untrusted, harden their encryption and DNS practices, and steadily move toward Zero Trust principles to limit the damage from any future AirSnitch‑style attacks.
