Mitigating De-Authentication DoS Attacks in 802.11 via eBPF and XDP

De-authentication Denial of Service (DoS) attacks in wireless networks allow adversaries to maliciously disassociate devices, interrupting communication and effectively denying service. The 802.11w protocol was designed to counter this issue using Protected Management Frames (PMF). However, our analysis reveals that during de-authentication DoS attacks, throughput drops significantly, and client disconnections may occur, exposing the limitations of the 802.11w protocol. Extended Berkeley Packet Filter (eBPF) and eXpress Data Path (XDP) technologies, recently adopted in wired networks to enhance packet processing efficiency, remain largely unexplored in wireless networks and their unique challenges, such as those posed by the 802.11 protocol. In this paper, we introduce a novel approach that integrates eBPF/XDP into the mac80211 Linux kernel module to mitigate de-authentication attacks in near real-time with minimal overhead. Our solution partially overcomes the shortcomings of the 802.11w protocol, offering a more robust defense.