Introduction
802.11 frames : A starter guide to learn wireless sniffer traces
Frame types
All lines in italic and smaller caracters refer to Contention-Free systems and are never implemented in 99% of the wireless devices, so of little importance.
|
Type value |
Type description |
Subtype value |
Subtype description |
Wireshark display filter |
|
00 |
Management |
0000 |
Association Request |
wlan.fc.type_subtype == 0x00 |
|
00 |
Management |
0001 |
Association Response |
wlan.fc.type_subtype == 0x01 |
|
00 |
Management |
0010 |
Reassociation Request |
wlan.fc.type_subtype == 0x02 |
|
00 |
Management |
0011 |
Reassociation Response |
wlan.fc.type_subtype == 0x03 |
|
00 |
Management |
0100 |
Probe Request |
wlan.fc.type_subtype == 0x04 |
|
00 |
Management |
0101 |
Probe Response |
wlan.fc.type_subtype == 0x05 |
|
00 |
Management |
0110-0111 |
Reserved |
|
|
00 |
Management |
1000 |
Beacon |
wlan.fc.type_subtype == 0x08 |
|
00 |
Management |
1001 |
ATIM |
wlan.fc.type_subtype == 0x09 |
|
00 |
Management |
1010 |
Disassociation |
wlan.fc.type_subtype == 0x0A |
|
00 |
Management |
1011 |
Authentication |
wlan.fc.type_subtype == 0x0B |
|
00 |
Management |
1100 |
Deauthentication |
wlan.fc.type_subtype == 0x0C |
|
00 |
Management |
1101 |
Action |
wlan.fc.type_subtype == 0x0D |
|
00 |
Management |
1110-1111 |
Reserved |
|
Type value |
Type description |
Subtype value |
Subtype description |
Wireshark display filter |
|
|
01 |
Control |
0000-0111 |
Reserved |
||
|
01 |
Control |
1000 |
Block Ack Request |
wlan.fc.type_subtype == 0x18 |
|
|
01 |
Control |
1001 |
Block Ack |
wlan.fc.type_subtype == 0x19 |
|
|
01 |
Control |
1010 |
PS-Poll |
wlan.fc.type_subtype == 0x1A |
|
|
01 |
Control |
1011 |
RTS |
wlan.fc.type_subtype == 0x1B |
|
|
01 |
Control |
1100 |
CTS |
wlan.fc.type_subtype == 0x1C |
|
|
01 |
Control |
1101 |
ACK |
wlan.fc.type_subtype == 0x1D |
|
|
01 |
Control |
1110 |
CF-end |
wlan.fc.type_subtype == 0x1E |
|
|
01 |
Control |
1111 |
CF-end + CF-ack |
wlan.fc.type_subtype == 0x1F |
|
|
Type value |
Type description |
Subtype value |
Subtype description |
Wireshark display filter |
|
|
10 |
Data |
0000 |
Data |
wlan.fc.type_subtype == 0x20 |
|
|
10 |
Data |
0001 |
Data + CF-ack |
wlan.fc.type_subtype == 0x21 |
|
|
10 |
Data |
0010 |
Data + CF-poll |
wlan.fc.type_subtype == 0x22 |
|
|
10 |
Data |
0011 |
Data +CF-ack +CF-poll |
wlan.fc.type_subtype == 0x23 |
|
|
10 |
Data |
0100 |
Null |
wlan.fc.type_subtype == 0x24 |
|
|
10 |
Data |
0101 |
CF-ack |
wlan.fc.type_subtype == 0x25 |
|
|
10 |
Data |
0110 |
CF-poll |
wlan.fc.type_subtype == 0x26 |
|
|
10 |
Data |
0111 |
CF-ack +CF-poll |
wlan.fc.type_subtype == 0x27 |
|
|
10 |
Data |
1000 |
QoS data |
wlan.fc.type_subtype == 0x28 |
|
|
10 |
Data |
1001 |
QoS data + CF-ack |
wlan.fc.type_subtype == 0x29 |
|
|
10 |
Data |
1010 |
QoS data + CF-poll |
wlan.fc.type_subtype == 0x2A |
|
|
10 |
Data |
1011 |
QoS data + CF-ack + CF-poll |
wlan.fc.type_subtype == 0x2B |
|
|
10 |
Data |
1100 |
QoS Null |
wlan.fc.type_subtype == 0x2C |
|
|
10 |
Data |
1101 |
Reserved |
wlan.fc.type_subtype == 0x2D |
|
|
10 |
Data |
1110 |
QoS + CF-poll (no data) |
wlan.fc.type_subtype == 0x2E |
|
|
10 |
Data |
1111 |
Qos + CF-ack (no data) |
wlan.fc.type_subtype == 0x2F |
|
|
11 |
Reserved |
0000-1111 |
Reserved |
||
Small words about each types
-Association request is sent by a station to associate to a BSS.
-Association response is sent in response to an association request
-Reassociation request is sent by a station changing association to another AP in the same ESS (so roaming between APs, or reassociating with the same AP)
-Reassociation response is the response to the reassociation request
-Probe request is sent by a station in order to “scan” for an SSID
-Probe response is sent by each BSS participating to that SSID
-Beacon is a periodic frame sent by the AP (or stations in case of IBSS) and giving information about the BSS
-ATIM is the traffic indication map for IBSS (in a BSS, the TIM is included in the beacon)
-Disassociation is sent to terminate the association of a station
-Authentication is the frame used to perform the 802.11 authentication (and not any other type of authentication)
-Deauthentication is the frame terminating the authentication of a station.
-Action is a frame meant for sending information elements to other stations (when sending in a beacon is not possible/best)
-PS-Poll is the Power-save poll frame polling for buffered frames after a wake-up from a station
-RTS is the request-to-send frame
-CTS is the clear-to-send frame (often response to RTS)
-ACK is the acknowledge frame sent to confirm receipt of a frame.
-Data frame is the basic frame containing data
-Null frame is a frame meant to contain no data but flag information
-QoS data is the QoS version of the data frame
-QoS null is the QoS version of the null frame
Here is what a general frame looks like. We will show what the frame control field contains and then explain the addresses fields.
Here is the frame control field detailed:
1.1 Protocol version field: 2 bits field that is currently set to 0 in 2007 revision of the standard. It will be incremented whenever a new revision of the standard comes out and shows fundamental incompatibility with previous versions.
1.2 and 1.3 Type and Subtype fields: Type is 2 bit long and Subtype is 4 bits long. The type indicates whether the frame is control, management or data and the subtype defines the frame more precisely. For values, please refer the to chunk “frame types”.
1.4 and 1.5 To DS and From DS: The following table show the meaning of these fields combinations.
|
To DS and From DS values |
Meaning |
|
To DS=0, From DS=0 |
A frame sent between two stations not being APs in a BSS or IBSS. It is also the case for all management and control frames (directly sent to the AP and not the DS) |
|
To DS=0, From DS=1 |
A frame sent by a station for an AP (destined to the DS) |
|
To DS=1, From DS=0 |
A frame exiting the DS for a station. |
|
To DS=1,From DS=1 |
Only frame using all four addresses fields. Seen in Wireless DS (mesh, repeater, …) where an AP sends a frame to another AP, it is exiting the DS and destined to the DS at the same time in that situation. |
What’s the point of these DS fields? They are useful to identify the addresses fields (see later here) and they can also help in tricky situations. For example, you see on both wired and wireless side a WLCCP frame with STA being the source and broadcast destination. It could be the station sending it or the AP but as it is broadcast, it appears on both sides and you don’t know. The DS fields will tell you the truth here.
1.6 More fragments: Bit set as 1 when more fragments are to follow. See in other chunk.
1.7 Retry: This bit is set as 1 when the frame is a retransmission of an earlier frame.
1.8 Power management field: Set as 1 when station will to sleep and 0 when station will stay awake. See in other chunk.
1.9 More Data: Used in power save mode to indicate to the station that more frames are buffered on the AP. See in other chunk.
1.10 Protected Frame: This bit is set as 1 with data frames and “authentication” management frames to indicate that the body of the frame can only be read if decrypted. This field used to be called “WEP encrypted” in earlier revisions.
1.11 Order field: This bit is set as 1 with non-QoS frames where the order of frames must be kept.
That’s it for the control field. Let’s review the general frame format again and explain the addresses fields:
2. Duration/ID: This field is an ID in PS-Poll mode, it then contains the Association ID of the station. In Qos and non-Qos frames, it has a duration meaning different in these two cases. It can basically be considered as the duration necessary to send the frame and the ACK. It helps other stations to wait for the right amount of time before checking the medium again.
3. The 4 addresses field can have different meanings as well. Here are the meanings :
Destination Address (DA) : Final recipient of the frame
Source Address (SA) : Original source of the frame
Receiver Address (RA) : Immediate receiver of the frame.
Transmitter Address (TA) : Immediate sender of the frame.
-ToDS=0,FromDS=0 situation. The frame is sent by a station to another station. The transmitter is the original source and the receiver is the end destination. So :
Address 1=RA/DA (identical)
Address 2=TA/SA (identical)
Address 3=BSSID
Address 4=n/a
-ToDS=0,FromDS=1 situation. The frame is being forwarded by an AP typically. In this case, the AP is the transmitter but not the original source. So :
Address 1=RA/DA (identical = end station)
Address 2=TA/BSSID (transmitter is the AP, it is also the BSSID by the way)
Address 3=SA (original station sending the frame)
Address 4=n/a
-ToDS=1,FromDS=0 situation. The frame is being sent from a station to the DS. Here the receiver will be typically the AP which is maybe not the final destination. So:
Address 1=RA/BSSID (receiver is the AP which is the BSSID)
Address 2=TA/SA (original station sending)
Address 3=DA (end station)
Address 4=n/a
-ToDS=1,FromDS=1 situation. The frame is sent from an AP to another. So the first AP is the transmitter but not the original source. The second AP is the receiver but not the destination.
Address 1=RA (end AP)
Address 2=TA (first AP)
Address 3= DA (end station)
Address 4=SA (original station)
4. Sequence control field: This field contains a 4 bit fragment number and 12 bit sequence number that helps in reconstituting multi-fragments frame as well as eliminate duplicate and mis-ordered frames.
5. Frame Check Sequence : CRC at the end of the frame to check its integrity. It is a basic check that can be seconded by another frame integrity check field depending on encryptions used.
With this document, you will find some sniffer traces attached. They are examples of DS bit set or not set in real scenarios. You will find below some comments about each traces.
If you wonder where to check the DS bits, go in the 802.11 header, frame control and then the flag bits.
0-0.pcap: This trace shows a series of frames containing 0 in both DS bits. This reflects a situation where a station (intel mac address) is joining an ESS (Airespace Mac addr). The frames are sent from the station directly to the access point and are not intended to the DS since the station didn’t join yet. Same goes for the other way, when the AP is sending a frame, the frame goes to a station and does not come from the DS but the AP itself. So all frames shown have 0 in “from DS” and “to DS”.
Another good examples are the RTS/CTS frames, those frames are directed from a station to another and to intended to the DS.
1-0.pcap: This trace is just moments after the previous trace in time. The station is going through the EAPOL exchange. There we can see that the frames sent by the station are “to the DS” and the frames sent back to the station are “from the DS”. All Data frames follow this logic (mostly) of being “to DS” when sent by the station and “from DS” when sent by the AP.
1-1.pcap: A first look at this trace would let you think that we are seeing a retransmission. However, a look at the DS bits shows you that the first frame is sent by the client. The second by an AP to the client. And most important, the third is from an AP to another AP. This is then a “repeater AP” situation! And nothing to do with a retransmission because of packet loss …
