In the IEEE 802.11 wireless LAN protocols (such as Wi-Fi), a MAC frame is constructed of common fields (which are present in all types of frames) and specific fields (present in certain cases, depending on the type and subtype specified in the first octet of the frame).

The very first two octets transmitted by a station are the Frame Control. The first three subfields within the frame control and the last field (FCS) are always present in all types of 802.11 frames. These three subfields consist of two bits Protocol Version subfield, two bits Type subfield, and four bits Subtype subfield.

Frame control

The first three fields (Protocol Version, Type and Subtype) in the Frame Control field are always present. The fields, in their order of appearance in transmission, are:

Protocol Version Type Subtype To-DS From-DS More-Fragments Retry Power Management More Data Protected frame +HTC/order

Protocol version subfield The two-bit protocol version subfield is set to 0 for WLAN (PV0) and 1 for IEEE 802.11ah (PV1). The revision level is incremented only when there is a fundamental incompatibility between two versions of the standard. PV1 description is incorporated in the latest 802.11-2020 standard.

Types and subtypes Various 802.11 frame types and subtypesType value (bits 3–2)Type descriptionSubtype value (bits 7–4)Subtype description00Management0000Association Request00Management0001Association Response00Management0010Reassociation Request00Management0011Reassociation Response00Management0100Probe Request00Management0101Probe Response00Management0110Timing Advertisement00Management0111Reserved00Management1000Beacon00Management1001ATIM00Management1010Disassociation00Management1011Authentication00Management1100Deauthentication00Management1101Action00Management1110Action No Ack (NACK)00Management1111Reserved01Control0000–0001Reserved01Control0010Trigger01Control0011TACK01Control0100Beamforming Report Poll01Control0101VHT/HE NDP Announcement01Control0110Control Frame Extension01Control0111Control Wrapper01Control1000Block Ack Request (BAR)01Control1001Block Ack (BA)01Control1010PS-Poll01Control1011RTS01Control1100CTS01Control1101ACK01Control1110CF-End01Control1111CF-End + CF-ACK10Data0000Data10Data0001–0011Reserved10Data0100Null (no data)10Data0101–0111Reserved10Data1000QoS Data10Data1001QoS Data + CF-ACK10Data1010QoS Data + CF-Poll10Data1011QoS Data + CF-ACK + CF-Poll10Data1100QoS Null (no data)10Data1101Reserved10Data1110QoS CF-Poll (no data)10Data1111QoS CF-ACK + CF-Poll (no data)11Extension0000DMG Beacon11Extension0001S1G Beacon11Extension0010–1111Reserved

Action frames Various 802.11 action frame categoriesCategory valueAction description802.11 revision0Spectrum management802.11h-20031QoS802.11e-20052DLS802.11e-20053Block ack802.11e-20054Public802.11k-20085Radio measurement802.11k-20086Fast BSS transition802.11r-20087HT802.11n-20098SA query802.11w-20099Protected dual of public action802.11w-200910WNM802.11v-201111Unprotected WNM802.11v-201112TDLS802.11z-201013Mesh802.11s-201114Multihop802.11s-201115Self-protected802.11w-200916DMG17Allocated to the WiFi Alliance18Fast Session Transfer19Robust AV Streaming20Unprotected DMG21VHT22Unprotected S1G23S1G24Flow Control25Control Response MCS Negotiation26FILS27CDMG28CMMG29GLK30HE31Protected HE32WUR33Reserved34Protected Fine Timing Frame …126Vendor-specific protected127Vendor-specific128–255Error

Action frames extend management frames to control a certain action. Some of the action categories are QoS, Block Ack, Public, Radio Measurement, Fast BSS Transition, Mesh Peering Management, etc. These frames are sent by a station when it needs to tell its peer for a certain action to be taken.

For example, a station can tell another station to set up a block acknowledgement by sending an ADDBA Request action frame. The other station would then respond with an ADDBA Response action frame.

Wi-Fi Neighbor Awareness Networking (NAN), also known as Wi-Fi Aware, service discovery frames are NAN-specific public action frames. They are used in Remote ID for example. Public action frames were first defined in IEEE 802.11k-2008.

ToDS and FromDS ToDS is one bit in length and set to 1 if destined to Distribution System, while FromDS is a one-bit length that is set to 1 if originated from Distribution System.

Retry Set to 1 if the Data or Management frame is part retransmission of the earlier frame. This bit is reused for different purpose in Control frame.

Protected frame Set to 1 if the Management Frame is protected by encryption as described in IEEE_802.11w-2009.

+HTC/order It is one bit in length and is used for two purposes:

It is set to 1 in a non-QoS data frame transmitted by a non-QoS WLAN station to indicate the frame being transmitted is using Strictly-Ordered service class (this use is obsolete and will be removed from the future 802.11 Standard). It is set to 1 in a QoS data or management frame transmitting at HT or higher rate to indicate that the frame contains HT Control field (see above)

References