802.11 MAC Layer Frame Formats and Technologies
Domain 2: 802.11 MAC Layer Frame Formats and Technologies
This domain tests your ability to parse the 802.11 MAC header field by field and to explain why a frame is addressed and flagged as it is. Expect questions on Frame Control bits, address mapping under the DS bits, QoS Control, and management frame body structure.
Frame Control and Duration/ID
The first two octets are Frame Control: Protocol Version (2 bits), Type (2), Subtype (4), ToDS, FromDS, More Fragments, Retry, Power Management, More Data, Protected Frame, and Order. Type 0 management, 1 control, 2 data, 3 extension. Duration/ID is the NAV value in microseconds for most frames; in PS-Poll it carries the AID.
Address fields
The four address fields are not fixed roles. With ToDS=0, FromDS=0 (IBSS or management), Address 1 = DA/RA, Address 2 = SA/TA, Address 3 = BSSID. ToDS=1, FromDS=0 (client to AP): Address 1 = BSSID/RA, Address 2 = SA, Address 3 = DA. ToDS=0, FromDS=1 (AP to client): Address 1 = DA, Address 2 = BSSID/TA, Address 3 = SA. ToDS=1, FromDS=1 (WDS): Address 1 = RA, Address 2 = TA, Address 3 = DA, Address 4 = SA.
QoS Control and HT Control
QoS Data frames add a 2-octet QoS Control: TID (0-15), EOSP, Ack Policy, A-MSDU Present, and queue size. The HT Control field (present when Order=1 in QoS data) carries link adaptation, CSI, and sounding requests. Management frames use fixed fields then information elements; beacons carry timestamp, beacon interval, capability, then SSID, supported rates, DS parameter set, and others.
Worked example
A QoS Data frame has ToDS=1, FromDS=0, Address 1 = 00:11:22:33:44:55, Address 2 = aa:bb:cc:dd:ee:ff, Address 3 = 66:77:88:99:aa:bb. Because it is client-to-AP, Address 1 is the BSSID/RA, Address 2 is the source client, Address 3 is the destination. If Address 1 equals the AP BSSID and Address 3 is a wired server, the frame is being sent uplink for distribution.
Traps
Memorize the DS-bit table rather than guessing from field names. Retry=1 means retransmission, not necessarily a duplicate at LLC. Protected Frame=1 only says the body is protected; it does not identify the cipher. More Fragments and the sequence/fragment number are separate. Do not call Address 1 always the destination; it is the receiver.