802.11 Physical (PHY) Layer Frame Formats and Technologies
Domain 1: 802.11 Physical (PHY) Layer Frame Formats and Technologies
This domain tests whether you can read a PHY capture from the preamble inward: which PPDU format is on the air, which fields carry rate and width information, and which parts are training versus signaling versus payload. Exam questions often show a PHY decode pane and ask you to identify a field, a modulation, or a guard interval.
PPDU structure and legacy formats
A PHY frame is a PPDU: preamble + PLCP header + data (PSDU). The PLCP sublayer maps MAC frames to the PMD. Legacy DSSS/HR-DSSS uses a long or short preamble, a 48-bit PLCP header, and 1/2/5.5/11 Mbps rates. ERP-OFDM and legacy OFDM use L-STF, L-LTF, L-SIG, then data. L-SIG carries rate and length at 6 Mbps, 4 microseconds per OFDM symbol.
HT, VHT, HE, EHT
802.11n HT mixed format: L-STF, L-LTF, L-SIG, HT-SIG (MCS, 20/40 MHz, guard interval, aggregation), HT-STF, HT-LTF(s), data. 802.11ac VHT: L-STF/L-LTF/L-SIG, VHT-SIG-A, VHT-STF, VHT-LTF(s), VHT-SIG-B, data. VHT-SIG-A carries width, MCS, streams; VHT-SIG-B carries length and is needed for MU. 802.11ax HE: L-STF, L-LTF, L-SIG, RL-SIG (repeated L-SIG), HE-SIG-A, HE-STF, HE-LTF(s), HE-SIG-B (MU only), data. HE adds OFDMA resource units and trigger-based uplink; HE-SIG-A carries format, BSS color, and RU allocation hints. 802.11be EHT extends with EHT-SIG and wider 320 MHz.
Worked example
A capture shows a VHT PPDU, 80 MHz, MCS 7, 2 spatial streams, 400 ns GI. What PHY rate? VHT MCS 7 at 80 MHz, one stream, short GI = 433.3 Mbps. Two streams double it: 866.7 Mbps. Reasoning: MCS index sets modulation (256-QAM) and coding (5/6); width sets subcarriers; streams multiply; short GI raises the symbol rate slightly. If the capture reported MCS 7 but only 1 stream, answer 433.3 Mbps.
Traps
Do not confuse a PPDU with an MPDU; a single PPDU can aggregate many MPDUs. Do not assume every HE PPDU has HE-SIG-B. Do not read channel width from the adapter configured width; decode it from SIG. Remember L-SIG is present in HT/VHT/HE for legacy protection, and RL-SIG is a repeated L-SIG, not a new field. Guard interval and coding are separate from MCS.