802.11 Frames

Management Frames

802.11 management frames make up a majority of the frame types in a WLAN. Management frames are used by wireless stations to join and leave the basic service set.

Management frames have a MAC header, a frame body, and a trailer; however, management frames do not carry any upper-layer information. There is no MSDU encapsulated in the MMPDU frame body, which carries only layer 2 information fields and information elements.

Sample Management frames



The following is a list of all 12 management frame subtypes as defined by the 802.11-2007 standard:

  • Association request
  • Association response
  • Reassociation request
  • Reassociation response
  • Probe request
  • Probe response
  • Beacon
  • Announcement traffic indication message (ATIM)
  • Disassociation
  • Authentication
  • Deauthentication
  • Action

Control Frames

802.11 control frames assist with the delivery of the data frames. Under ideal conditions, control frames should be heard by all stations within a BBS; therefore, they must be transmitted at one of the basic rates.

Control frames are also used to clear the channel, acquire the channel, and provide unicast frame acknowledgments. They contain only header information and a trailer. Control frames do not have a frame body.

clear to send – cts


Request to send – rts

filter on control frames

The following is a list of all eight control frame subtypes as defined by the 802.11 standard:

  • Power Save Poll (PS-Poll)
  • Request to send (RTS)
  • Clear to send (CTS)
  • Acknowledgment (ACK)
  • Contention Free-End (CF-End)
  • CF-End + CF+ACK
  • Block ACK Request (BlockAckReq)
  • Block ACK (BlockAck)

Data Frames

Most 802.11 data frames carry the actual MSDU data that is passed down from the higher-layer protocols. The layer 3–7 MSDU payload is normally encrypted for data privacy reasons.

However, some 802.11 data frames carry no MSDU payload at all but do have a specific MAC control purpose within a basic service set.

Any data frames that do not carry a MSDU payload are not encrypted because a layer 3–7 data payload does not exist. There are a total of 15 data frame subtypes. The data subtype is usually referred to as the simple data frame.

The simple data frame has MSDU upper-layer information encapsulated in the frame body. The integration service that resides in autonomous APs and WLAN controllers takes the MSDU payload of a simple data frame and transfers the MSDU into 802.3 Ethernet frames.

Null function frames are sometimes used by client stations to inform the access point of changes in Power Save status.

The following is a list of all 15 data frame subtypes as defined by the 802.11 standard:
  • Data (simple data frame)
  • Null function (no MSDU payload)
  • Data + CF-ACK
  • Data + CF-Poll
  • Data + CF-ACK + CF-Poll
  • CF-ACK (no MSDU payload)
  • CF-Poll (no MSDU payload)
  • CF-ACK + CF-Poll (no MSDU payload)
  • QoS data
  • QoS Null (no MSDU payload)
  • QoS data + CF-ACK
  • QoS data + CF-Poll
  • QoS data + CF-ACK + CF-Poll
  • QoS CF-Poll (no MSDU payload)
  • QoS CF-ACK + CF-Poll (no MSDU payload)

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.