802.11 Protocol Analysis
Frame taxonomy
802.11 has three frame types. Management (association request 0/response 1, reassociation 2/3, probe request 4/response 5, beacon 8, disassociation 10, authentication 11, deauthentication 12, action 13) builds and tears down relationships. Control (BlockAckReq 8, BlockAck 9, PS-Poll 10, RTS 11, CTS 12, ACK 13, CF-End 14) arbitrates the medium. Data carries MSDUs, with QoS Data (subtype 8) and Null (subtype 4) used for power-save signalling.
Fields that get tested
The 2-byte Frame Control holds protocol version, type, subtype, ToDS/FromDS, More Fragments, Retry, Power Management, More Data, Protected Frame and Order. Duration/ID sets the NAV. Sequence Control (12-bit sequence, 4-bit fragment) lets receivers discard duplicates and underpins replay detection in CCMP. The 4-byte FCS is validated last; a bad FCS means the frame is dropped before analysis.
Address mapping - the classic trap
- ToDS=0, FromDS=0 (IBSS or management): Addr1=DA, Addr2=SA, Addr3=BSSID.
- ToDS=1, FromDS=0 (client to AP): Addr1=BSSID, Addr2=SA, Addr3=DA.
- ToDS=0, FromDS=1 (AP to client): Addr1=DA, Addr2=BSSID, Addr3=SA.
- ToDS=1, FromDS=1 (WDS/mesh): Addr1=RA, Addr2=TA, Addr3=DA, Addr4=SA.
Worked example
A capture from a laptop to an AP shows ToDS=1, FromDS=0, and Addr1 equals the AP radio MAC. Read it immediately as: Addr1 is the BSSID, Addr2 is the source (the laptop), Addr3 is the destination beyond the AP. Candidates who assume Addr1 is always the destination lose the point.