802.11 Frame Structure and Services Notes

Functional Model: Frame Structure and Addressing

Duration/ID Field

  • Function: Indicates communication duration or identification information.
  • Content Dependence: Its contents vary based on the frame type/subtype and the transmitting device's QoS capabilities.
  • Examples:
    • RTS/CTS frames: Specifies the duration of the communication.
    • Data frames: Contains the Association ID (AID).
  • AP Transmissions:
    • When an Access Point (AP) sends a data frame, this field indicates the expected duration of the transmission, including the anticipated ACK (Acknowledgment).
    • The ACK frame's Duration/ID is 0.
  • STA Behavior:
    • A Station (STA) whose AID is present in the TIM (Traffic Indication Map) field of a Beacon frame sends a PS-Poll frame to the AP to retrieve buffered traffic.
    • The STA's AID is included in the PS-Poll's Duration/ID field.

MAC Addresses

  • IEEE 802.3 Compatibility: MAC address fields are compatible with IEEE 802.3 standards.
  • Source and Destination: Two MAC address fields specify the source and destination addresses.
  • Address Types:
    • Unicast: For specific devices.
    • Multicast/Broadcast: For multiple devices.
  • Number of MAC Addresses:
    • An 802.11 frame can contain up to four MAC addresses, contingent on the network configuration.

Address Types and Network Configuration

  • Transmitter Address (TA): The MAC address of the device that transmitted the frame.
  • Receiver Address (RA): The MAC address of the device intended to receive the frame.
  • Source Address (SA): The MAC address of the device that originally created the data.
  • Destination Address (DA): The MAC address of the ultimate recipient of the data.
  • Infrastructure-BSS: STAs communicate through APs, which forward frames to the ultimate recipients.
  • Independent-BSS (IBSS):
    • The MAC header contains only two addresses (TA=SA and RA=DA).
    • STAs communicate directly with each other.

Address Fields in Frame Header

  • Address 1 (Receiver):
    • The node that receives the frame on the wireless interface.
    • Responsible for sending the ACK.
  • Address 2 (Transmitter):
    • The node that sends the frame on the wireless interface.
  • Address 3 & 4:
    • Take on different values depending on the network operating mode.
  • BSSID (Broadcast Service Set Identifier):
    • Uniquely identifies a BSS.
    • Infrastructure-BSS: The BSSID is identical to the MAC address of the AP that forms the BSS.
    • IBSS: The BSSID is a random 48-bit number (in MAC address format).

To DS and From DS Fields

  • Purpose: These fields indicate the frame's path relative to the Distribution System (DS).
    • To DS = 0, From DS = 0: Ad-hoc or IBSS Communication (STA-to-STA).
    • To DS = 0, From DS = 1: Frame leaving the DS (from AP to STA).
    • To DS = 1, From DS = 0: Frame entering the DS (from STA to AP).
    • To DS = 1, From DS = 1: Frame being distributed within the DS (AP to AP).

MAC Address Attacks

  • Essential for Communication: MAC addresses are essential for network communication.
  • Inherent Insecurity: Transmitted in cleartext, making them susceptible to attacks.
    • Key Risks: Spoofing, Impersonation, Masquerading, and Connection Hijacking.
  • Common Attacks:
    • Spoofing: An attacker uses a stolen MAC address to gain unauthorized access.
    • Impersonation/Masquerading: An attacker pretends to be another device using its MAC address.
    • Connection Hijacking: An attacker takes over an existing connection by manipulating MAC addresses.
  • MAC Filtering: A Weak Defense
    • Commonly used, but easily bypassed by MAC spoofing.
    • Provides a false sense of security; not a primary defense.
  • Defense Strategies
    • 802.1X Authentication:
      • Authenticates devices before granting network access.
      • Port-based network access control.
      • Requires an authentication server for verification.
      • Key Benefit: Eliminates reliance solely on MAC addresses for access.
    • Defense in Depth
      • WPA2/3, leveraging strong encryption, provides robust protection against MAC address attacks, greatly increasing the difficulty of successful spoofing
      • MAC Randomization: Makes tracking devices harder, but doesn't eliminate spoofing.
      • Intrusion Detection/Prevention (IDS/IPS): Monitors for suspicious MAC address activity.
      • Network Segmentation: Limits the impact of a successful attack.

Additional Frame Control Fields

  • (Cont'd from #28): Sequence control: Bits 0-3 define the fragment number, while the remaining 12 bits represent the sequence number. This field is absent in control frames
  • QoS control:
    • Added in the 802.11e amendment.
    • Used to manage traffic classes and priorities.
    • Only present in QoS data frames.
  • HT control:
    • Added in the 802.11n standard.
    • Used in high-throughput communication for link adaptation and beamforming.

Frame Body and FCS

  • Frame body (variable size): Contains the 802.11 MAC service data unit (MSDU) - Payload.
    • Can be cryptographically protected (WEP, WPA, WPA2, WPA3, etc.).
    • Maximum size is version dependent.
    • E.g., with WEP, max size = 2,312 bytes = 2304 + 4 (ICV) + 4 (WEP IV).
  • Frame check sequence (FCS):
    • Uses a Cyclic Redundancy Check (CRC) for data integrity verification.
    • Detects transmission errors.

Control and Management Frames

  • Frame Sizes: Control and management frames are generally smaller than data frames.
  • Management Frames:
    • Do not contain a fourth MAC address.
    • Facilitate communication between a STA and an AP, or between STAs in an ad-hoc network.
    • MAC header length is 24 bytes in 802.11a/b/g and 28 bytes in 802.11n (due to the 4-byte HT Control field).
  • Control Frames:
    • Contain either one or two MAC addresses.
    • Do not include a frame body or a sequence control field.
  • Management frames are used in security-related operations within a BSS
  • A PVO(type = 00) management frame can be:
    • Beacon - 1000
    • Probe (request & response) - 0100/0101
    • Authentication - 1011
    • Association (request & response) - 0000/0001
    • Reassociation (request & response) - 0010/0011
    • Disassociation - 1010
    • Deauthentication - 1100
    • Action - 1101
    • Action no ack (NACK) - 1110
    • Timing advertisement - 0110 (802.11p-2010)
    • Announcement Traffic Indication Message (ATIM) - 1001 (ad-hoc only)
    • Reserved - 0111

Detailed Management Frame Information

  • Common Fields: The Frame Control, Duration/ID, Address 1, Address 2, Address 3, and Sequence Control fields are present in all management frame subtypes. The presence of the HT Control field is determined by the +HTC subfield within the Frame Control field (see #27).
  • Address 3: The value of Address 3 depends on the specific management frame subtype and context. For example, in a Probe Request frame, Address 3 can be the wildcard BSSID (a BSSID with all bits set to 1s). For a non-mesh STA, Address 3 can also contain the BSSID of the intended recipient's BSS. For a mesh STA, it can contain the MAC address of the intended recipient.
  • Frame Body: The frame body comprises fields and elements as defined for each management frame subtype. E.g., a beacon frame can contain numerous fields and elements (sometimes exceeding 75), providing detailed information about the BSS.

Structure of a Beacon Frame

  • Mandatory Fields:
    • Timestamp
    • Beacon Interval
    • Capabilities Information
  • Optional Fields:
    • SSID Parameter Set
    • Supported Rates
    • Traffic Indication Map (TIM)
    • Country Information
    • Power Constraint
    • TPC Report
    • ERP
    • Extended Rates
    • Robust Security Network

IEEE 802.11 Beacon Frame: Detailed Breakdown

  • Type/Subtype: Beacon frame (0x0008)
  • Frame Control Field: 0x8000
    • Version: 0
    • Type: Management frame (0)
    • Subtype: 8
  • Flags: 0x00
  • Duration: 0 microseconds
  • Receiver address: Broadcast (ff:ff:ff:ff:ff:ff)
  • Destination address: Broadcast (ff:ff:ff:ff:ff:ff)
  • Transmitter address: ASUSTekC_54:fe:34 (0c:9d:92:54:fe:34)
  • Source address: ASUSTekC_54:fe:34 (0c:9d:92:54:fe:34)
  • BSS Id: ASUSTekC_54:fe:34 (0c:9d:92:54:fe:34)
  • Fragment number: 0
  • Sequence number: 906
  • Frame check sequence: 0xf6b9ff5c [unverified]
  • Fixed parameters (12 bytes)
    • Timestamp: 11549900860
    • Beacon Interval: 0.102400 [Seconds]
  • Capabilities Information: 0x1111
  • Tagged parameters (246 bytes)
    • SSID parameter set: ASUS_5G
    • Supported Rates 6(B), 9, 12(B), 18, 24(B), 36, 48, 54, [Mbit/sec]
    • Traffic Indication Map (TIM): DTIM 3 of 3 bitmap
      • Tag Number: Traffic Indication Map (TIM) (5)
      • Tag length: 4
      • DTIM count: 2
      • DTIM period: 3
      • Bitmap control: 0x00
      • Multicast: False

Association Request Frame

  • Listen Interval Field: Within the Association Request frame, the Listen Interval field communicates to the AP how frequently a STA in power save mode will wake up to listen for Beacon frames. This interval is expressed in units of Beacon Intervals (see #11). A Listen Interval value of 0 typically indicates that the STA will not enter power save mode. The AP can use this information to determine the appropriate duration for buffering frames destined for the STA.

Control Frames (PV0)

  • Common Fields: Control frames share some common fields. All control frame subtypes include the Frame Control, Duration/ID, and Address 1 (RA) fields. Address 2 (TA) is present in certain control frame subtypes, but not all. For example, CTS frames and ACK frames do not include a TA; such frames are designed to be as short and efficient as possible to minimize overhead and contention on the wireless medium. Other control frames, such as RTS frames, do include both an RA and a TA.
  • ACK Frame Structure: The structure of an ACK frame is shown below (see #19):
    • Frame Control
    • Duration
    • RA
    • FCS

802.11 Frame Classes

  • Categories: 802.11 frame types are categorized into three classes, which dictate which frames a STA is permitted to transmit based on its current state within the network.
  • State-Based Permissions:
    • State 1: only Class 1 frames are allowed.
    • State 2: only Class 1 or Class 2 frames are allowed.
    • State 3 and State 4: all frames (Classes 1, 2, and 3) are allowed.
  • IBSS Restrictions: In an IBSS only Class 1 and Class 2 frames are allowed because there is no DS.
  • State Definitions:
    • State 1: Initial state; not authenticated and not associated.
    • State 2: Authenticated but not yet associated.
    • State 3: Authenticated and associated (RSNA authentication pending).
    • State 4: Authenticated and associated (RSNA established or not required). It requires a successful 4-way handshake.

Frame Examples by Class

  • Class 1:
    • Control: RTS, CTS, ACK, CF-End
    • Management: Probe Request, Probe Response, Beacon, Authentication
    • Data: Data frames between IBSS STAs (any frame with ToDS and From DS false)
  • Class 2:
    • Control: None
    • Management: Deauthentication, Announcement traffic indication message (ATIM), Association Request/Response, Reassociation Request/Response, Disassociation
    • Data: None
  • Class 3:
    • Control: PS-Poll, BlockAck, BlockAckReq
    • Management:
      • In an infrastructure BSS, MBSS, or PBSS, all Action and Action No Ack frames, except those classified as Class 1 or Class 2. Action Frames are a type of management frame used to trigger an action in the cell, e.g., Block ACK, Spectrum Management, SA Query, etc. These frames, may or may not require an ACK. The requirement for an ACK depends on the specific Action frame type and the applicable 802.11 standard. Action No Ack frames are a specific subset of Action frames that are designed to never require an acknowledgment
    • Data: Data frames between STAs in an infrastructure BSS or in an MBSS (any frame including those with either the To DS or From DS bits set)

802.11 Services

  • Categories: The IEEE 802.11 standard defines 15 services, categorized into three groups: Station Services (SS), Point Coordination Protocol Services (PCPS), Distribution System Services (DSS).
  • IBSS Applicability: In an IBSS (ad-hoc network), only SS are applicable. Since there's no AP or DS, PCPS and DSS are irrelevant.
  • BSS/PBSS Applicability: In a BSS or a PBSS, both SS and PCPS are applicable. However, PCPS is rarely used in modern Wi-Fi networks (see #44). DSS is not applicable in a PBSS. DSS is relevant only within an ESS; since the DS (and by extension, DSS) is what defines an ESS, it's logically impossible to have DSS without an ESS.
  • DSS Services:
    • Association: It is used by a STA to establish a connection with an AP. When an STA comes within range of an AP, it uses the Association service to announce its identity and capabilities. The AP can then accept or reject the STA's request. Prior to association, the STA must have already completed the authentication process with the AP. This service is not applicable to MBSS because MBSS networks are P2P, lacking the central AP structure on which association and disassociation depend.
    • Disassociation: It can be initiated by either the STA or the AP at any time. It is used to terminate an existing association between the STA and the AP. This service is also not applicable to MBSS.

PCF/DCF Explanation

  • PCPS Obsolescence: PCPS is rarely used in modern Wi-Fi networks (802.11ax, 802.11be, and beyond) because its centralized polling mechanism, the Point Coordination Function (PCF), introduces significant overhead, limiting scalability and efficiency compared to the distributed, contention-based approach of DCF, which is better suited for the bursty and unpredictable traffic patterns of today's Wi-Fi usage.
  • Analogy: Imagine a classroom where the teacher (the AP) wants to give each student (STA) a chance to speak.
    • PCF: is like the teacher calling on each student one by one. This is organized, but it takes a long time, especially if there are many students. If some students don't have much to say, the teacher wastes time calling on them. PCF applies to traditional Wi-Fi networks (802.11a/b/g/n/ac).
    • DCF: is like students raising their hands when they have something to say. It's a bit more chaotic -- sometimes two students might try to speak at once (a "collision"), but they quickly figure out who gets to speak first. This is much faster overall, especially if most students have something to say.
    • Modern Wi-Fi is like the classroom with students raising their hands (DCF). While the teacher calling on everyone is more organized, it's just too slow for a busy classroom.
  • CF-End Frame Example: The CF-End frame (see #42) is a control frame used in older Wi-Fi networks (specifically those implementing the Point Coordination Function - PCF) to signal the end of a Contention-Free Period (CFP). The AP would start a CFP by sending a beacon frame. Then, it would poll stations one by one, giving each a chance to transmit without competition. After polling the necessary stations, the AP would signal the end of the CFP, and the network would return to the normal contention-based operation (using DCF).

Remaining Categories of 802.11 Services

  • Reassociation: Using this service, a STA can move to a different (new) AP within the same ESS. This capability is useful for roaming STAs, enabling a smooth transfer of the connection to the new AP. It can also be used if the STA left the cell for a short period and wishes to rejoin. This service is not applicable to MBSS
  • Distribution: This service defines how frames sent to APs are routed. If the recipient is outside the current cell, the frames must be forwarded through the wireless network or a wireless bridge.
  • Integration: This service relates to interworking with heterogeneous networks. If a frame needs to be routed through a network that does not follow the 802.11 standard, the Integration service is responsible for converting the frame from the 802.11 format to the format required by the destination network.
  • QoS traffic scheduling: See #47
  • DSE: See #48
  • Interworking with the DS (mesh only): As mentioned in #8, a mesh STA that has direct access to a DS is called a mesh gate. Other mesh STAs in an MBSS access the DS via the mesh gate

Station Services (SS)

  • Components:
    • Authentication (including pre-authentication): Every STA must authenticate its identity before being allowed to associate with an AP and subsequently send or receive data
    • Deauthentication: If an STA leaves the network, its authentication is revoked, preventing the STA from further accessing network resources
    • Data confidentiality: Information transmitted over the network should be protected to maintain communication privacy
    • MSDU delivery: Because 802.11 is based on the Ethernet model (best-effort), transmission is not 100% reliable. Higher-layer protocols (like TCP) are responsible for handling potential errors and, if possible, correcting them
  • Why Authentication is SS and Association is DSS?
    • Authentication (Local action by the STA): "Hi, I'm John's STA. Here's my proof"
    • Association (Network-level action by the AP as part of managing the distribution system): "Okay, John's STA, you're authenticated. Welcome to the network. I'll set things up for you"

Additional 802.11 Services

  • Dynamic frequency selection (DFS): Required to comply with regulatory requirements in the 5 GHz band. Its primary purpose is to prevent interference with radar systems by dynamically detecting radar signals and switching to a different channel if necessary.
  • Higher layer timer synchronization (TPC): Also related to 5 GHz regulatory compliance, TPC ensures that devices operate within specified transmit power limits. This often involves adjusting transmit power based on channel conditions and regulatory domain requirements. The term "Higher Layer Timer Synchronization" is less common; TPC is the more frequently used and accurate term.
  • QoS traffic scheduling: It provides QoS frame transfers within a BSS using the Hybrid Coordination Function (HCF). HCF employs both contention-based channel access (for Enhanced Distributed Channel Access - EDCA* - see #48) and controlled channel access (for the now rarely used Point Coordination Function PCF) to prioritize different types of traffic. This QoS traffic scheduling applies to all QoS-enabled STAs except mesh STAs. Mesh networks have their own separate QoS mechanisms.

Advanced 802.11 Services Explained

  • Radio measurement: This capability allows a STA to monitor and collect data about radio link performance and the radio environment. An STA can perform local measurements, request measurements from another STA, or be requested by another STA to perform measurements and report the results
  • Dynamic STA enablement (DSE): It automates the channel provisioning and regulatory controls required for unregistered 802.11 STAs to operate as dependent STAs in licensed spectrum. Essentially, it streamlines the process of getting new devices onto the network while adhering to regulatory rules. That is, there's a set of rules and procedures that new Wi-Fi devices must follow before they can be allowed to use the licensed radio frequencies. This is often because the licensed spectrum has stricter rules than unlicensed spectrum, and there needs to be a way to ensure that all devices using it are authorized and configured correctly to avoid interference. DSE automates this process.
  • DCF vs EDCA: DCF (see #44) is the basic access method in the original 802.11 standard. It uses Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). It provides a “best-effort" service, meaning all traffic is treated equally. EDCA is an enhancement introduced in the 802.11e standard to provide QoS. It builds upon DCF by providing differentiated access to the wireless medium. EDCA categorizes traffic into different Access Categories, such as voice, video, best-effort, and background, and assigns different priorities to each. Therefore, EDCA is an enhanced version of DCF that adds QoS capabilities.

PBSS Control Point Services

  • Specifically operate within Personal Basic Service Sets (PBSS) in 802.11ad (WiGig) networks, utilizing the 60 GHz band
  • The PBSS Control Point (PCP), a role any station within a PBSS can assume, manages the network
  • Key PCP responsibilities include device association, disassociation, reassociation, and QoS traffic scheduling