Frame injection

Frames generated by attacker have the sequence number out of sequence order of the correct frames

Multiple frames with the same payload can be detected (may not be the sign of the attacker, e.g. ICMP echo requests)

Due to the fact that CRC checksum of the frame applies also to IV values (in addition to payload), the attacker has to keep these values => we can detect a lot of frames with the same IV