> How does one send packets to 192.168.X.Y without being on that network already? It's not sending IP packets; the attacker figures out the wi-fi MAC of the c

> How does one send packets to 192.168.X.Y without being on that network already? It's not sending IP packets; the attacker figures out the wi-fi MAC of the client they want to deauth, then spoofs that MAC in 802.11 "deauth" frames sent to the access point. The access point then complies by cleaning up whatever data structures it's using to keep track of the client, and when it receives the next packets from the client, it doesn't know who it's talking to anymore. The attacker doesn't need to authenticate to the wifi network to send these frames. At the most they might need root/admin on their machine because you have to send custom packets and that's generally restricted, but as the original article said, there are custom boards that are designed just for deauthing attacks.