Every Wi-Fi generation changed what a frame looks like. This topic lets you build the MAC header of each protocol, field by field, and see what was added, how many bytes it costs and why.
1. DefinitionFrames, MSDUs and PPDUs
- MSDU (MAC service data unit): the payload handed down from the layer above, for example an IP packet with its 8-byte LLC/SNAP header. Up to 2304 bytes.
- MPDU (MAC protocol data unit): the real MAC frame: MAC header, frame body and FCS. This is what Wireshark calls an 802.11 frame.
- A-MSDU / A-MPDU: several MSDUs inside one frame, or several MPDUs sent back to back (aggregation, from 802.11n).
- PSDU (PHY service data unit): what the PHY carries, which is one MPDU or an A-MPDU.
- PPDU (PHY protocol data unit): the PSDU with the PHY preamble in front of it. This is what actually goes on the air.
- FCS (frame check sequence): a 32-bit CRC at the end of the MPDU.
The three kinds of frame
- Management frames set up and manage the network: beacons, probes, authentication, association, deauthentication.
- Control frames help deliver the others: RTS, CTS, ACK, Block Ack, and in 802.11ax the Trigger frame. They are short and have no sequence number.
- Data frames carry user traffic (and QoS Data frames carry a priority).
2. PurposeWhy the header looks like this
The header answers four questions for the receiver, in as few bytes as possible: who is this for and from (addresses), what kind of frame is it (Frame Control), how long will the channel be busy (Duration), and is this a repeat (Sequence Control). Each new generation added only the fields it needed (priority, then feedback for beamforming), and kept the rest the same so that old and new devices could share a channel.
3. MechanismBuild the header of each protocol
Choose a protocol and a frame type. The boxes are the real fields in transmission order, with their widths in bytes. Orange-edged boxes are fields that this protocol added. Click any box for its meaning and its bits; switch To DS and From DS on a data frame to see the addresses change meaning.
Try this. (1) Choose QoS Data and move from 802.11e to 802.11n and tick +HTC: the header grows from 26 to 30 bytes. (2) Choose Data and turn both To DS and From DS on: a fourth address appears. (3) Click Beacon and step from 802.11 to 802.11ac: the frame body gains the HT and VHT elements. (4) Choose Trigger in 802.11ax and add clients: each one costs 5 bytes. (5) Click Frame Control and step through the protocols: the last bits and the list of frame subtypes change with each one.
4. VisualWhat changed from protocol to protocol
| Protocol | What it added to frames | Cost |
|---|---|---|
| 802.11 (1997), b, a, g | Frame Control, Duration, three addresses, Sequence Control, FCS; an optional fourth address for bridges and mesh; RTS, CTS, ACK | 24-byte header (30 with a fourth address) |
| 802.11e (QoS) | QoS Control field in QoS Data frames: traffic identifier, ack policy, A-MSDU present, queue size; Block Ack. Frame Control: subtype bit 7 becomes the QoS flag (new QoS data subtypes); new Block Ack Request and Block Ack subtypes | +2 bytes |
| 802.11n (Wi-Fi 4) | HT Control field (+HTC); A-MSDU and A-MPDU aggregation; compressed Block Ack; HT elements in management frames. Frame Control: the Order bit becomes +HTC; new Control Wrapper and Action No Ack subtypes | +4 bytes; +28 and +24 bytes of elements in a beacon |
| 802.11ac (Wi-Fi 5) | VHT variant of the HT Control field; larger MPDUs (up to 11 454 bytes) and A-MPDUs (up to 1 048 575 bytes); VHT elements. Frame Control: new Beamforming Report Poll and VHT NDP Announcement subtypes | same 4 bytes; +14 and +7 bytes of elements |
| 802.11ax (Wi-Fi 6) | HE variant of the HT Control field (a list of small control items); Trigger frame; HE elements. Frame Control: a new Trigger subtype | same 4 bytes; Trigger frame 28 + 5 per client |
| 802.11be (Wi-Fi 7) | Extends the same header and control items; EHT elements; larger aggregates | same 4 bytes |
The HE and EHT details come from the 802.11ax and 802.11be amendments; the earlier rows are from IEEE Std 802.11-2020.
The Frame Control field changes too. It is always 16 bits, but each protocol claimed unused subtype values for its new frames, the Order bit became +HTC in 802.11n, and the WEP bit was renamed Protected Frame. Click Frame Control in the builder above and switch protocol to see the bits and the list of subtypes change. The 2020 edition of the standard no longer lists the point-coordination (PCF) data subtypes such as Data + CF-Poll: they were defined in 1997 but are now reserved, so the builder dims them.
Who is Address 1, 2, 3 and 4?
The same three address fields change meaning with the To DS and From DS bits, depending on whether the frame is going into or out of the access point. This is the table from the standard (Table 9-30):
| To DS | From DS | Address 1 | Address 2 | Address 3 | Address 4 |
|---|---|---|---|---|---|
| 0 | 0 | Destination (receiver) | Source (transmitter) | BSSID | not present |
| 0 | 1 | Destination (receiver) | BSSID (the AP, transmitter) | Source | not present |
| 1 | 0 | BSSID (the AP, receiver) | Source (transmitter) | Destination | not present |
| 1 | 1 | Receiver | Transmitter | Destination | Source |
A client sending to the access point uses 1 / 0. The access point forwarding to a client uses 0 / 1. 1 / 1 is used between access points in a bridge or mesh, which is the only reason a fourth address exists.
5. MathematicsSizes and overhead
- Header length = 24 + 6 (if To DS and From DS are both 1) + 2 (if QoS Data) + 4 (if +HTC). Management frames are 24 bytes (+4 with +HTC).
- Control frames: RTS 20 bytes (Frame Control 2, Duration 2, two addresses 12, FCS 4); CTS and ACK 14 bytes; Block Ack 32 bytes in its compressed form (152 bytes in the original 802.11e form with a 128-byte bitmap); a Trigger frame 28 + 5 × (number of clients) bytes.
- Security overhead: TKIP adds 20 bytes (8-byte IV, 8-byte MIC, 4-byte ICV), CCMP-128 adds 16 (8-byte header and 8-byte MIC), CCMP-256 24, GCMP 24 (8-byte header and a 16-byte MIC), WEP 8.
- Overhead of one frame = (header + security + FCS) / frame size. For a QoS Data frame with CCMP, the overhead is 26 + 16 + 4 = 46 bytes: 3.0% of a frame carrying 1500 bytes, but 31% of one carrying 100 bytes.
- An A-MSDU subframe is a 14-byte header (destination 6, source 6, length 2), the MSDU, and padding to a multiple of 4 bytes. An A-MPDU subframe is a 4-byte delimiter (1 + 1 + 14 + 8 + 8 bits: end-of-frame flag, reserved, MPDU length, CRC, and the signature 0x4E), the MPDU, and padding to a multiple of 4.
| Limit | Size |
|---|---|
| MSDU and management frame body | 2304 bytes |
| A-MSDU (802.11n) | 3839 or 7935 bytes |
| MPDU (802.11ac) | 3895, 7991 or 11 454 bytes |
| PSDU (802.11n) | 65 535 bytes |
| PSDU (802.11ac) | 4 692 480 bytes |
From IEEE Std 802.11-2020, Table 9-25. A larger frame is a bigger gamble: one bit error in it spoils the whole frame, unless the frames are aggregated as separate MPDUs.
6. Real-world behaviourThe preamble and aggregation
The MAC header is only half the story. In front of every frame the PHY adds a preamble. The first part is always the legacy preamble, so that any device can read the length and stay quiet; later generations add their own fields behind it, and the preamble grows with the number of spatial streams.
Each frame also pays for waiting for the channel and for its acknowledgement, which is why aggregation was invented. An A-MSDU shares one header across several packets; an A-MPDU keeps a header for each frame but shares the preamble, the wait and the acknowledgement.
Worked example. Eight packets of 300 bytes at 300 Mbit/s, QoS Data with CCMP. Sent as eight separate frames, they take about 1528 µs and deliver 4% of the data rate. As an A-MSDU they take about 252 µs (25%), and as an A-MPDU about 262 µs (24%): six times faster, from the same radio, just by not repeating the wait, the preamble and the acknowledgement.
- Retries show up in the header. The Retry bit and the repeated sequence number tell you which frames were sent again.
- Mixed networks pay too. To keep old devices quiet, a newer frame starts with the legacy preamble and sometimes a protection exchange.
- Capture tools add their own header. A monitor-mode capture starts every frame with a radiotap header (signal, rate, channel); that is not part of the 802.11 frame.
Practical validationProve it in a capture and on a spectrum analyser
Reading about a band is one thing; seeing it in your own evidence is the skill. These checks work with any monitor-mode capture:
- In a capture, filter on each frame type with
wlan.fc.type_subtype, for example0x0008for a beacon and0x0028for a QoS Data frame, and compare the header lengths. Open the Frame Control field and find the To DS and From DS bits (wlan.fc.ds). - Find a retry (
wlan.fc.retry == 1) and look at its sequence number (wlan.seq): it repeats the number of the original. - Open a beacon and expand the tagged parameters: look for HT Capabilities (tag 45), VHT Capabilities (tag 191) and the HE and EHT capability elements, and add up their sizes.
- Question to answer: a client’s data frame to the access point has To DS = 1, From DS = 0. What would Address 3 hold if the client is browsing a website?
Check your understandingQuick quiz
ReferencesSources and further reading
- IEEE Std 802.11-2020 (IEEE Xplore)
- IEEE 802.11 Working Group: standards timelines (approval and publication dates)
- Wireshark display filter reference: IEEE 802.11 (wlan)
- Wireshark display filter reference: radiotap
Frame formats, field sizes and bit layouts were checked against IEEE Std 802.11-2020: Frame Control (Figures 9-3 and 9-4, subtype values in Table 9-1, +HTC and Protected Frame in 9.2.4.1.9 and 9.2.4.1.10), Sequence Control (9-7), QoS Control (Table 9-10), HT Control (Figures 9-11, 9-12 and 9-16), the address table (Table 9-30), size limits (Table 9-25), the A-MPDU delimiter (Table 9-527), A-MSDU subframes (Figure 9-69), CCMP and GCMP expansion (12.5.3 and 12.5.5) and the HT preamble timings (Table 19-6). HE and EHT items come from the 802.11ax and 802.11be amendments, which are not in the 2020 edition. Check Wireshark field names against your version.