Abstract: Wireless communications systems may detect network attacks based on analysis of medium access control (MAC) addresses and origination locations associated with incoming authentication requests. For example, a DoS attack may be detected by determining (e.g., via a database) whether a particular MAC address is associated with multiple authentication request messages without proceeding to an authentication step. According to the described techniques, a system (e.g., an AP, controller/cloud, etc.) may maintain a database of authentication requests and associated MAC addresses, timestamps, and location information. As such, upon reception of an authentication request corresponding to a MAC address, the MAC address may be compared to the database. If the delta (e.g., timestamp difference) between authentication requests from a same MAC address is less than a threshold, the system may detect a potential DoS attack by a client associated with the MAC address and the MAC address may be removed from the AP.