All posts
Wi-Fi · Security

How the NAV Can Break Wi-Fi

What Is NAV?

NAV (Network Allocation Vector) is a virtual carrier-sensing mechanism in Wi‑Fi that helps a device determine how long the wireless medium is expected to remain reserved for an ongoing or upcoming transmission exchange. A STA uses the Duration/ID field in received MAC frames to set or update its NAV. While the NAV timer is running, the STA considers the medium reserved and defers contention for new transmissions.

Normal Uses

  1. Unicast Transmission and ACK: When a device transmits a unicast frame and expects an ACK, the duration information can reserve the medium for the expected frame exchange. Other devices use this information to defer transmission during the reserved period.
  2. RTS/CTS and A-MPDU Transmission: Before transmitting a large A-MPDU, a device may send an RTS with a duration that covers the expected exchange, including CTS → A-MPDU → BlockAck and SIFS. Other devices receiving the reservation information set their NAV accordingly and defer access to the medium for the duration of the exchange.
  3. Mobile Hotspot / Concurrent Client + AP Operation: Some mobile hotspot implementations operate as both a Wi‑Fi client and an AP and need to switch between these roles. For example, while operating as an AP, the device may transmit a CTS-to-self frame with an appropriate duration to reserve the medium on its AP channel. It can then temporarily switch to its client role to perform its own transmission/reception and return to AP operation before the reserved period expires. This allows the device to coordinate its use of the radio across its different roles. The reservation does not grant it access to a different client channel.

NAV Update Rules

  1. Maximum Duration Value: The Duration/ID field is 16 bits. For ordinary duration values, the highest bit is 0, leaving 15 bits for the duration. The maximum value is 32,767 µs.
  2. Updating the NAV Timer: Under the normal NAV update rules, if a device is already counting down its NAV and receives a frame containing a shorter duration than the remaining NAV, it does not shorten the existing NAV. If the received duration is longer than its current NAV, it updates the applicable NAV to the new duration. For example: Current NAV remaining: 5 ms
    Received duration: 2 ms
    Result: NAV remains at 5 ms
    If the received duration is 7 ms, NAV is updated to 7 ms.
  3. Releasing the Reserved Medium Early: A station holding a TXOP may send a CF-End frame to indicate early completion. Receivers can reset the relevant NAV and resume contention when channel-access conditions permit.

Misusing NAV

Devices can update their NAV even when a received frame comes from another BSS, not just their own. CTS control frames are not Protected, so their receiver address and duration information can be spoofed.

A single CTS frame can advertise a duration of up to 32.767 ms. On its own, this only causes temporary deferral because the NAV eventually counts down to zero.

The interesting part is when an attacker continuously refreshes the NAV.

In my experiment, the transmitter and the affected AP were separate devices. I first transmitted a CTS-to-self with a 32 ms Duration value, then scheduled another one 20 ms later with the same duration. At that spacing, a device that accepted the first frame would have about 12 ms remaining on its NAV, but the new frame would reserve the medium for another 32 ms. I repeated this process continuously, with a configured interval of 20 ms between submissions.

Wireshark capture of the experiment: a column of 802.11 Clear-to-send frames timestamped roughly 20 ms apart, with the frame-detail pane of the selected CTS showing a Duration of 32000 microseconds (32 ms) and its receiver address

Because each new duration is greater than the device's current remaining NAV, the device keeps extending its NAV instead of allowing it to reach zero. In other words, it does not get an opportunity to contend for the channel while this continues.

Throughput chart titled Bitrate per 1-second interval, in Mbit/s plotted at each interval's midpoint. The line holds between roughly 200 and 340 Mbit/s, peaking at 337, then drops vertically to zero at 82 seconds. A shaded region annotated 'Stalled from 82 s — 19 intervals, 0 Mbit/s (one 4.19 Mbit/s blip at 83 s)' covers the rest of the run, with the line flat at zero through 100 seconds
Throughput drop to zero

This can also prevent an affected AP from getting access to the medium to transmit beacons. In my experiment, after around 10 to 20 seconds, the connected clients disconnected and started moving to another band.

I then repeated the same experiment on other channels in other bands. Once the CTS-to-self transmissions were running on all the tested channels, the clients lost connectivity completely and did not reconnect until I stopped transmitting.

Diagram of the experiment: an attacker at a laptop transmits a spoofed CTS flood with Duration = 32 ms toward a wireless router. A crossed-out Wi-Fi symbol sits below the router, and the four surrounding client devices — a desktop PC, a TV, a smartphone and a laptop — each show a disconnected Wi-Fi icon
All client devices disconnected

This demonstrates how the NAV mechanism, although designed to coordinate access to the wireless medium, can potentially be abused to create a continuous channel reservation and a Wi‑Fi denial-of-service condition.

— Gopi Raga