Introduction
With the widespread enterprise deployment of Wi-Fi 7 (IEEE 802.11be), network architecture has undergone its most radical transformation in a decade. At the heart of this evolution is Multi-Link Operation (MLO). Unlike legacy dual-band configurations, which merely allow a device to failover between 2.4 GHz, 5 GHz, and 6 GHz bands, MLO treats these bands as a unified, concurrent connection. A single Multi-Link Device (MLD) can stream data across multiple physical bands simultaneously, dramatically slashing latency and boosting throughput.
However, this multi-lane highway introduces a highly complex, distributed state machine. Securing a session that spans multiple frequency bands—each with its own physical characteristics, noise levels, and link-state transitions—presents a brand-new attack surface. Security researchers and digital forensics professionals are now encountering a sophisticated vector: MLO Session Hijacking and State Desynchronization.
In this deep dive, we will dissect how MLO manages connection states, expose the mechanics of a link-state desynchronization attack, walk through a real-world forensic analysis using packet captures, and outline concrete, actionable defense strategies for modern enterprise networks.
Under the Hood: How MLO Handles State and Sessions
To understand how an attacker can exploit MLO, we must first look at how the 802.11be standard structures its architecture. Wi-Fi 7 splits the traditional MAC (Medium Access Control) layer into two sublayers:
- Upper MAC (UMAC): Manages link-independent protocols, encryption keys, sequence numbers, and traffic stream filtering. It presents a single logical interface to the upper network layers.
- Lower MAC (LMAC): Manages the physical-layer (PHY) operations for each individual link (e.g., the 5 GHz link and the 6 GHz link separately).
When a client MLD associates with an Access Point (AP) MLD, they perform a single, unified 4-Way Handshake to establish a Pairwise Master Key (PMK) and Pairwise Transient Key (PTK). This cryptographic session is shared across all active links. However, each individual physical link retains its own unique MAC address, link identifier (Link ID), and frame sequence numbers.
This hybrid architecture relies on constant synchronization. If the AP and the client disagree on which links are active, or if the cryptographic sequence numbers (Packet Numbers/PN) on one link drift out of synchronization with the UMAC state, the entire connection can become unstable—or vulnerable to targeted exploitation.
The Threat Vector: MLO State Desynchronization
The core of the vulnerability lies in the transition mechanisms between operating modes, specifically Enhanced Multi-Link Single Radio (eMLSR) and Simultaneous Transmit and Receive (STR). To save power, many mobile client MLDs dynamically tear down or suspend auxiliary links when traffic is low, resuming them when demands spike. This negotiation is governed by unencrypted or weakly protected link-state management frames.
An attacker can exploit this by targeting a weaker or more congested link (typically the legacy 5 GHz or 2.4 GHz band) while leaving the high-speed 6 GHz link untouched. By executing a highly targeted, localized attack, the adversary forces a State Desynchronization.
The Attack Anatomy
- Link-Specific Frame Injection: The attacker monitors the target MLD’s multi-link footprint. Using a specialized Wi-Fi 7 injection framework, the attacker injects a spoofed Multi-Link Teardown or Link-Transition frame targeting the 5 GHz link. This frame is crafted to look like it originated from the client’s secondary MAC address.
- Inducing the State Split: If the AP processes the spoofed teardown frame before the client can transmit on that link, the AP tears down its local 5 GHz link state, reallocating its resources and resetting its expected sequence numbers for that specific Link ID. Crucially, the client MLD still believes the 5 GHz link is active.
- Sequence Number Hijacking: Because the client’s UMAC is still routing packets across both channels, it transmits a payload on the 5 GHz link. The AP rejects this packet because the link-state is “closed” or “inactive.” However, the attacker, positioned as a Man-in-the-Middle (MitM), intercepts this transmission. Because the attacker knows the current cryptographic sequence number (PN) from the active 6 GHz link, they can forge subsequent state-restoration requests, successfully inserting themselves into the session on the newly re-established 5 GHz link.
“By driving a wedge between the physical link state and the logical session state, an attacker can bypass traditional session-timeout protections and inject arbitrary frames into the client’s network stream.”
Forensic Investigation: Spotting MLO Attacks in PCAPs
When investigating a suspected session hijack or anomalous network drop on a Wi-Fi 7 network, standard forensic tools like Wireshark must be configured to parse the new 802.11be Information Elements (IEs). Analysts must pay close attention to the Multi-Link Element (ID 107).
Below is a representation of what to look for when analyzing a packet capture (PCAP) of an MLO desynchronization event:
1. Anomalous Link-ID Mapping Changes
In a healthy session, the mapping of Link IDs to physical MAC addresses remains constant throughout the association. During an attack, you will observe sudden, unprovoked association updates. Look for the following signature in your packet analyzer:
IEEE 802.11 Wireless LAN
Tagged parameters
Tag: Multi-Link Element (107)
Control: Presence Bitmap: 0x07 (Link ID, Link MAC, Connection Control)
Link ID: 1 (5 GHz Physical Link)
Link MAC Address: [Client's 5 GHz LMAC]
Connection Control: Disconnect / Teardown (Anomalous Origin)
If this frame is transmitted without a corresponding Block Ack or is immediately followed by a transmission from the client on the same Link ID with an incremented sequence number, it indicates a state mismatch.
2. Packet Number (PN) Drift and Replays
Because the logical UMAC shares the cryptographic key, the Packet Number (PN) used to prevent replay attacks must increment globally or follow strict per-link allocation rules. In a desynchronization attack, you will observe a sudden drop or reset in the PN on the compromised link while the other link continues to transmit normally. This is a primary indicator of a replay or injection attempt.
Frame 4012: Link ID 1 (5 GHz) -> PN: 104230 (Encrypted Payload) Frame 4015: Link ID 2 (6 GHz) -> PN: 104231 (Encrypted Payload) Frame 4022: Link ID 1 (5 GHz) -> PN: 104230 (Duplicate/Replayed or Out-of-Sequence Frame)
This sequence indicates that an attacker is attempting to replay a state-negotiation frame or inject data using an outdated physical link context.
Mitigation and Defensive Architecture
Securing Wi-Fi 7 networks against MLO state exploits requires a combination of strict protocol enforcement and modern wireless intrusion prevention. Relying on default configurations is no longer sufficient.
1. Mandatory Protected Management Frames (PMF)
While WPA3 mandates PMF, many enterprise environments deploy transition modes (WPA2/WPA3 mixed) to accommodate legacy devices. This is a critical security vulnerability. If legacy devices must be supported, they should be isolated to a dedicated, single-link SSID. The primary enterprise SSID utilizing Wi-Fi 7 and MLO must enforce strict PMF (802.11w) on all bands. This prevents attackers from injecting unauthenticated link teardown and transition frames.
2. Implement MLO-Aware Wireless Intrusion Prevention Systems (WIPS)
Legacy WIPS are blind to multi-link correlations. They see a 2.4 GHz, 5 GHz, and 6 GHz connection as three unrelated devices or simple dual-band clients. Deploy a modern, MLO-aware WIPS that can track the state of a single client MLD across multiple physical channels. The WIPS should trigger an alert if it detects:
- Link state transitions (e.g., tearing down a link) occurring outside of normal power-save negotiation windows.
- MAC address spoofing targeting only one physical interface of a known multi-link client.
- Discrepancies in the Multi-Link Element fields transmitted across different bands.
3. Tuning Link-State Transition Timers
Network administrators should configure access points with conservative timeout values for inactive links. If a client MLD stops responding on a specific link (for example, due to local RF interference or targeted jamming), the AP should gracefully teardown the entire MLD association rather than allowing an orphaned link state to persist in an insecure or half-open state.
Conclusion
Wi-Fi 7’s Multi-Link Operation is a massive leap forward for wireless performance, but its architectural complexity creates fertile ground for state-exploitation techniques. By understanding the division between the Upper and Lower MAC layers, and recognizing how physical link states can be desynchronized from the logical session, security teams can proactively hunt for these anomalies. Implementing strict PMF, deploying MLO-aware monitoring tools, and maintaining a robust forensic posture are essential steps to keeping the wireless enterprise secure in this new era of multi-link connectivity.