A method for protecting 802.11 ax networks includes receiving, by an access point, a plurality of Single User (SU) Quality of Service (QOS) NULL frames from a station, tracking, by the access point as the plurality of SU QOS NULL frames are received, a variable in one or more of the plurality of SU QOS NULL frames, determining, by the access point and based on tracking the variable, the station is suspicious, sending, by the access point and in response to determining the station is suspicious, a request to check a status of the variable, determining, by the access point and based on a response to the request, the station is under attack, and flagging, by the access point, the station as under an attack.