WiFi Frame Format

When you connect your laptop to a WiFi network, browse the web, or stream video, you're witnessing the result of an intricate choreography of wireless frames exchanged between your device and the access point. Unlike wired Ethernet, where collision detection and simple frame formats suffice, wireless networks face fundamental challenges: devices cannot hear each other reliably, the medium is inherently unreliable, and multiple devices must coordinate in a hostile electromagnetic environment.

The IEEE 802.11 standard addresses these challenges by defining a sophisticated frame architecture that divides all wireless communication into three distinct frame types: Management, Control, and Data frames. Each type serves a unique purpose, and together they orchestrate the complex dance that transforms chaotic radio signals into reliable network connectivity.

Understanding these frame types is not merely academic—it's essential for network engineers who troubleshoot connectivity issues, security professionals who analyze wireless traffic, and system architects who design high-performance wireless infrastructure.

Wired Ethernet operates in a relatively simple environment. A device sends a frame onto a shared medium, and all other devices on the same collision domain can hear it. Collision detection (CSMA/CD) works reliably because every transmitter can sense its own transmission and detect overlapping signals.

Wireless networks face fundamentally different challenges:

These challenges necessitate a three-tier frame architecture. Management frames handle the administrative overhead of establishing and maintaining network associations. Control frames coordinate medium access and provide acknowledgments. Data frames carry the actual network payloads. Each tier addresses specific aspects of wireless networking complexity.

The fundamental insight: While wired Ethernet can function with a single frame type (data frames with implicit medium access), wireless networks require explicit coordination at multiple levels. The frame type architecture is not complexity for its own sake—it's the minimum necessary structure to achieve reliable communication in an unreliable, unguided medium.

Management frames are the administrative backbone of wireless networking. They handle every aspect of discovering networks, establishing connections, and managing the wireless infrastructure. Without management frames, devices would have no way to find access points, authenticate themselves, or join networks.

Management frames are identified by Type value 00 in the Frame Control field. They constitute the largest category in terms of subtypes, reflecting the complexity of wireless network management.

Deep Dive: Connection Lifecycle

The management frame subtypes directly map to the stages of wireless connection establishment:

Stage 1: Network Discovery

• Passive Scanning: The client listens for Beacon frames that APs broadcast at regular intervals (typically every ~102.4ms). Beacons contain the SSID, supported rates, security parameters, and timing information.
• Active Scanning: The client sends Probe Request frames (optionally specifying a target SSID) and collects Probe Response frames from APs within range.

Stage 2: Authentication

• Once the client selects a network, it exchanges Authentication frames with the AP. In Open System Authentication, this is a simple two-frame handshake. In Shared Key Authentication (deprecated), a four-frame challenge-response occurs. Modern WPA/WPA2/WPA3 uses Open System Authentication followed by a separate 802.1X/EAPOL handshake.

Stage 3: Association

• After authentication, the client sends an Association Request containing its capabilities (supported rates, QoS requirements, security parameters). The AP responds with an Association Response that includes a status code and, if successful, an Association ID (AID).

Stage 4: Operation

• Once associated, the client can send and receive data. Action frames handle dynamic adjustments like radio resource management, Quality of Service negotiations, and fast BSS transitions between APs.

Stage 5: Disconnection

• Clean disconnection uses Disassociation (terminates association but preserves authentication) or Deauthentication (terminates both). These frames can be sent by either party.

Control frames are the traffic signals of wireless networking. They coordinate access to the shared medium, confirm successful transmissions, and manage power save mechanisms. Control frames are the most time-critical frames in 802.11—they must be transmitted with minimal delay to ensure proper protocol operation.

Control frames are identified by Type value 01 in the Frame Control field. They are typically short (often only the MAC header and FCS) to minimize airtime and reduce collision probability.

The Critical Control Frame Trio: RTS, CTS, and ACK

Three control frames form the backbone of reliable 802.11 operation:

1. Request to Send (RTS) Before transmitting a frame larger than the RTS threshold, a station sends an RTS frame to the destination. The RTS contains:

• The destination address
• The Duration field indicating how long the medium will be busy

Allstations that receive the RTS set their Network Allocation Vector (NAV) to remain silent for the specified duration, implementing virtual carrier sensing.

2. Clear to Send (CTS) Upon receiving an RTS, the destination responds with a CTS if the medium is indeed clear from its perspective. The CTS:

• Confirms medium availability
• Contains its own Duration field (RTS duration minus CTS time)
• Silences any hidden terminals that couldn't hear the RTS

3. Acknowledgment (ACK) After successfully receiving any unicast frame, the recipient transmits an ACK frame. This is mandatory in 802.11—unlike Ethernet where ACKs are absent:

• The ACK confirms successful reception
• No ACK triggers retransmission by the sender
• ACKs must be sent after a Short Interframe Space (SIFS), the shortest waiting time in 802.11

The timing is critical: ACKs must be sent within SIFS time (10μs for legacy 802.11, 16μs for 802.11a/g). This tight timing is why ACK generation is handled in hardware, not software.

Data frames carry the actual network payloads—the information users care about. Every HTTP request, video stream packet, VoIP conversation, or file transfer ultimately travels inside 802.11 data frames. However, data frames in 802.11 are more complex than their Ethernet counterparts due to wireless-specific addressing and optimization features.

Data frames are identified by Type value 10 in the Frame Control field. They include the full address fields (up to four addresses) and carry encrypted or unencrypted payloads.

Understanding Data Frame Variants

Pure Data Frames (Subtype 0000-0011) These are the basic carriers of network payloads. The CF (Contention-Free) variants were designed for the Point Coordination Function (PCF) mode where an AP could grant stations contention-free access. While PCF is rarely deployed, these subtypes remain in the standard.

Null Data Frames (Subtype 0100-0111) Null frames carry no payload but serve critical signaling functions:

• A station entering power-save mode sends a Null frame with the Power Management bit set
• A station leaving power-save mode sends a Null frame with the bit cleared
• Null frames may trigger buffered frame delivery from the AP

QoS Data Frames (Subtype 1000-1100) Introduced with 802.11e and mandated in 802.11n/ac/ax, QoS data frames include a QoS Control field that enables:

• Traffic prioritization (Voice, Video, Best Effort, Background)
• Traffic Identifier (TID) for stream differentiation
• ACK policy selection (Normal, No-Ack, Block-Ack)
• Mesh routing information in 802.11s deployments

The Data Frame Payload Structure

A data frame's payload contains:

┌─────────────────────────────────────────────────────────────────┐
│                         802.11 Data Frame                        │
├──────────────────┬──────────────────────────────────────────────┤
│   MAC Header     │              Frame Body                       │
│   (24-30 bytes)  │              (0-2312 bytes)                   │
├──────────────────┼──────────────────────────────────────────────┤
│ Frame Control    │  ┌────────────────────────────────────────┐ │
│ Duration/ID      │  │  LLC/SNAP Header (8 bytes)              │ │
│ Address 1-4      │  │  DSAP=0xAA, SSAP=0xAA, Ctrl=0x03       │ │
│ Sequence Control │  │  OUI=0x000000, Type=0x0800 (IP)         │ │
│ QoS Control*     │  ├────────────────────────────────────────┤ │
│ HT Control*      │  │  MSDU (IP packet, etc.)                 │ │
│                  │  │  (0-2304 bytes)                         │ │
│                  │  ├────────────────────────────────────────┤ │
│                  │  │  MIC (if encrypted)                     │ │
│                  │  │  ICV/MIC (8-16 bytes)                   │ │
│                  │  └────────────────────────────────────────┘ │
├──────────────────┴──────────────────────────────────────────────┤
│                         FCS (4 bytes)                            │
└─────────────────────────────────────────────────────────────────┘

The LLC/SNAP header bridges 802.11 to upper layer protocols. The EtherType field (e.g., 0x0800 for IPv4, 0x86DD for IPv6) identifies the payload type, enabling seamless integration with Ethernet infrastructure.

Every 802.11 frame begins with a two-byte Frame Control field that enables immediate classification. Understanding this field is essential for packet capture analysis and protocol debugging.

Frame Control Field Structure:

Practical Example: Wireshark Analysis

When analyzing WiFi captures in Wireshark, you'll commonly see:

Frame 1: Beacon (Type=0, Subtype=8)
  Frame Control: 0x8000
  Binary: 1000 0000 0000 0000
  Type=00 (Management), Subtype=1000 (Beacon)

Frame 2: Probe Request (Type=0, Subtype=4)
  Frame Control: 0x4000
  Binary: 0100 0000 0000 0000
  Type=00 (Management), Subtype=0100 (Probe Request)

Frame 3: ACK (Type=1, Subtype=13)
  Frame Control: 0xD400
  Binary: 1101 0100 0000 0000
  Type=01 (Control), Subtype=1101 (ACK)

Frame 4: QoS Data (Type=2, Subtype=8)
  Frame Control: 0x8802
  Binary: 1000 1000 0000 0010
  Type=10 (Data), Subtype=1000 (QoS Data)
  To DS=1, From DS=0 (Station to AP)

Understanding the typical distribution of frame types helps network engineers set expectations for what they'll observe in captures and identify anomalies that may indicate problems or attacks.

Typical Frame Distribution in Active Networks:

Key Observations:

1. Control frames are surprisingly common — Because every unicast data frame requires an ACK, control frames constitute a substantial portion of airtime. In high-throughput scenarios with Block ACK, this overhead decreases.

2. Beacon frames are constant overhead — With beacons every ~100ms per AP and SSID, environments with many access points generate substantial beacon traffic regardless of data activity.

3. Management frame spikes indicate events — Sudden increases in Probe Requests suggest new devices scanning. Increases in Disassociation/Deauthentication may indicate attacks or connectivity issues.

4. Retransmissions inflate counts — The Retry bit in Frame Control indicates retransmissions. High retry rates significantly increase frame counts without corresponding data throughput.

Understanding how frame types interact in common scenarios solidifies the conceptual model. Let's trace through several typical wireless operations:

Scenario 1: Client Connects to Network

Scenario 2: Station Sends HTTP Request

Scenario 3: Station Enters Power Save Mode

We've explored the three fundamental frame types that make WiFi possible. Each serves an irreplaceable role in the wireless communication stack:

What's Next:

Now that we understand the frame type taxonomy, we'll dive into the detailed Frame Structure—examining every field of the 802.11 MAC header, understanding the variable-length header configurations, and learning how the Frame Control, Duration, Address, and Sequence Control fields work together to enable wireless communication.