MANAGEMENT FRAMES (Type = 00) - Never carry data payload | Addr1=DA Addr2=SA Addr3=BSSID15 rows#
| MGMT | 0 | 0x00 | Association Request | Assoc Req | STA → AP | No | No | Basic / lowest | SSID, Supported Rates, Extended Supported Rates, HT/VHT/HE/EHT Capabilities, RSN IE, Power Capability, Listen Interval, MBO IE (opt), OWE DHE (opt) | Assoc response timeout ≈ 1-5 s (vendor); STA retries after timeout | dot11AssocRequestCount dot11AssociateFailedCount | wlan.fc.type_subtype==0 | Sent after successful 802.11 Authentication. Contains everything the STA wants the AP to know about its capabilities. If AP rejects (Status≠0), STA may retry with lower capabilities. |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MGMT | 1 | 0x01 | Association Response | Assoc Resp | AP → STA | No | No | Basic / lowest | Status Code (0=success), AID (1-2007 for legacy; 1-8191 for ax), Supported Rates, HT/VHT/HE/EHT Operation, EDCA params, TIM/DTIM period, BSS Max Idle Period | AID assigned on success; AID reused after disassoc + timeout | dot11AssociationResponsesTransmitted dot11AssocSuccessCount | wlan.fc.type_subtype==1 | Status code 0 = success. Common failure codes: 1=Unspecified, 11=Association denied (no memory), 12=STA not supporting all required rates, 17=Insufficient bandwidth. AID identifies STA in TIM bitmap. |
| MGMT | 2 | 0x02 | Reassociation Request | Reassoc Req | STA → AP | No | No | Basic / lowest | Current AP Address (previous BSSID), SSID, Capabilities, RSN IE, HT/VHT/HE/EHT Caps, Listen Interval, FT IEs (if 802.11r), MDE/FTE | Roam timer starts; if no response within timeout → re-scan | dot11ReassociateFailedCount dot11RoamLatencyMeasurement (vendor) | wlan.fc.type_subtype==2 | Used during BSS transition (roam). Carries previous BSSID so new AP can request context transfer. With 802.11r, FT IEs carry pre-derived PMK-R1 for fast key handshake. |
| MGMT | 3 | 0x03 | Reassociation Response | Reassoc Resp | AP → STA | No | No | Basic / lowest | Status Code, new AID, Supported Rates, HT/VHT/HE Op, EDCA params, FT IEs (if 802.11r), RIC Response | Completes roam; new link active immediately on success | dot11ReassociationResponsesTransmitted | wlan.fc.type_subtype==3 | On success, the roam is complete. The 4-way handshake follows (unless 802.11r used pre-derived keys). Monitoring roam latency = (Reassoc Req TX time) to (4-way Handshake complete). |
| MGMT | 4 | 0x04 | Probe Request | Probe Req | STA → AP / Broadcast | No | No | Lowest basic or 1 Mbps | SSID (wildcard = broadcast scan), Supported Rates, Extended Rates, DS Parameter Set (channel), HT/VHT/HE Caps, Interworking IE (Passpoint), Extended Caps | Active scan: STA dwells on channel 10-110 ms per channel, sends Probe Req, waits for responses; MinChannelTime / MaxChannelTime timers | dot11ProbeRequestsTransmitted dot11ProbeSuccessCount | wlan.fc.type_subtype==4 | Wildcard SSID probe = discovers all BSSs. Directed probe = specific SSID. On 6 GHz, APs do not respond to legacy-rate probe requests - FILS Discovery and Unsolicited Probe Responses are used instead. |
| MGMT | 5 | 0x05 | Probe Response | Probe Resp | AP → STA | No | No | Basic rate (matched to Probe Req) | Full beacon content minus TIM; all capability IEs included; sent at basic rate; includes RNR IE (6 GHz pointer), Unsolicited Probe Resp flag | Sent SIFS after Probe Req (unicast) or asynchronously (unsolicited at 20 ms intervals for 6 GHz) | dot11ProbeResponsesTransmitted | wlan.fc.type_subtype==5 | On 6 GHz: AP sends Unsolicited Probe Responses every 20 ms on the primary 20 MHz channel to allow discovery without requiring STA to already know the channel. Directed Probe Response is unicast to the requesting STA. |
| MGMT | 6 | 0x06 | Timing Advertisement | TA | AP → Broadcast | No | No | Basic rate | Timing Capabilities element, Country IE, Timestamp, Clock Offset, Error Bound, Time Source, Time Difference | Periodic; used in IEEE 1588 / 802.11p sync contexts | dot11TimingAdvertisementTransmitted (rare) | wlan.fc.type_subtype==6 | Used in 802.11p (WAVE/V2X) for time synchronization. Rarely seen in standard Wi-Fi deployments. Allows STAs to align clocks for TDMA-like coordination in vehicular networks. |
| MGMT | 7 | 0x07 | Reserved | - | - | - | - | - | - | - | - | - | Not defined; discard on receipt. |
| MGMT | 8 | 0x08 | Beacon | BCN | AP → Broadcast | No (body) +PMF for some action | No | Lowest basic rate (1 or 6 Mbps) | Timestamp (8 bytes, TSF), Beacon Interval (2 bytes, TU), Capability Info (2 bytes), SSID, Supported Rates, DS Param Set, TIM (DTIM period + bitmap), RSN IE, HT/VHT/HE/EHT Operation, BSS Color (HE), RNR IE (6 GHz), FILS Indication, Vendor Specific IEs | TSF timer: 64-bit microsecond clock; beacon sent at every Beacon Interval (default 100 TU = 102.4 ms); TBTT = Target Beacon Transmission Time; DTIM countdown in TIM IE | dot11BeaconTransmitted dot11BeaconCount (per BSS) | wlan.fc.type_subtype==8 | Most important management frame. All STAs sync their TSF clock to received beacon timestamps. TIM bitmap (up to 2008 bits) indicates which AIDs have buffered unicast frames. DTIM beacon (every N beacons) also flushes multicast/broadcast buffer. |
| MGMT | 9 | 0x09 | ATIM | ATIM | STA → STA (IBSS) | No | No | Basic rate | No body - frame header only | ATIM window: fixed period after TBTT in IBSS; receiver must stay awake during ATIM window | dot11ATIMTransmitted | wlan.fc.type_subtype==9 | Announcement Traffic Indication Message - used only in IBSS (ad-hoc) power save mode. A STA sends ATIM to notify a peer it has buffered frames before the peer goes back to sleep. Essentially obsolete in infrastructure Wi-Fi. |
| MGMT | 10 | 0x0A | Disassociation | Disassoc | Either (AP or STA) | YES - 802.11w PMF | No | Basic rate | Reason Code (2 bytes): 1=Unspecified, 3=Leaving BSS, 4=Inactivity timeout, 5=AP overloaded, 8=STA leaving (explicit), 15=4WHS timeout, 34=TDLS teardown | No response expected; triggers immediate roam scan on client side; AP starts aging timer | dot11DisassociateCount dot11DisassociateReceivedCount | wlan.fc.type_subtype==10 | Without PMF (802.11w), Disassoc frames can be forged - classic deauth attack. With WPA3 (PMF mandatory), disassoc is encrypted and integrity-protected. Monitor for unexpected Disassoc with reason 3 - may indicate rogue AP. |
| MGMT | 11 | 0x0B | Authentication | Auth | Both (bi-directional exchange) | No (pre-assoc) | No | Lowest basic rate | Auth Algorithm (0=Open System, 1=Shared Key [broken], 3=SAE Commit/Confirm, 4=FT-over-Air), Sequence Number (1,2 or 1,2,3,4 for SAE), Status Code, Challenge Text (Shared Key only), SAE Scalar/Element (SAE Commit), SAE Confirm (SAE Confirm), Anti-Clogging Token (SAE optional) | Auth timeout ≈ 1-5 s; SAE Commit-Confirm round-trip; FT Auth adds FT IE processing; anti-clogging token timer for DoS protection | dot11AuthenticateFailedCount dot11AuthenticateSuccessCount dot11SAECommitReceived (vendor) | wlan.fc.type_subtype==11 | Open System (alg=0): seq1 from STA, seq2 from AP - always status 0. Effectively a no-op for WPA2. SAE (alg=3): Commit (seq1↔2) exchanges Diffie-Hellman elements; Confirm (seq3↔4) proves knowledge of password. SAE is the only method resistant to offline dictionary attacks. |
| MGMT | 12 | 0x0C | Deauthentication | Deauth | Either (AP or STA) | YES - 802.11w PMF | No | Lowest basic rate | Reason Code: 1=Unspecified, 2=Previous auth no longer valid, 6=Class 2 frame (data from unassoc STA), 7=Class 3 from unauth STA, 23=IEEE 802.1X auth failed, 47=Disconnected - poor link (MBO) | Resets auth state machine immediately; client goes to unassociated state; triggers full re-auth/assoc sequence | dot11DeauthenticateCount dot11DeauthenticateReceivedCount dot11DeauthReasonCode (vendor MIB) | wlan.fc.type_subtype==12 | Highest severity management frame - terminates all state. Without PMF, trivially forged: aireplay-ng -0 sends broadcast deauths to disconnect all clients. With WPA3/PMF mandatory, protected by CCMP/GCMP. Reason 6/7 (Class 2/3 frame) = client sending data without association - often a client bug after AP restart. |
| MGMT | 13 | 0x0D | Action | Action | Either | Category-dependent | No | Basic rate | Category (1B) + Action Code (1B) + Body: Cat 0: Spectrum Mgmt (CSA, Measurement) Cat 1: QoS (EDCA update) Cat 3: Block Ack (ADDBA Req/Resp/DELBA) Cat 4: Public (GAS/ANQP Passpoint) Cat 5: Radio Measurement (Neighbor Report Req/Resp, Link Measurement) Cat 6: Fast BSS Transition (FT Auth/FT ACK) Cat 7: HT (Notify channel width, SM Power Save) Cat 9: SA Query (PMF liveness check) Cat 10: Protected Dual of Public Action Cat 13: Mesh (PREQ/PREP/PERR) Cat 19: Unprotected SA Query Cat 21: VHT (Operating Mode Notification, Beamforming) Cat 25: FILS (Discovery) Cat 30: HE (TWT Setup/Teardown, BSS Color Change, EDCA update, MU EDCA) Cat 36: EHT (TID-to-link mapping, MLO Probe Request) Cat 255: Vendor Specific | ADDBA negotiation: timeout if no ADDBA Resp → fallback to non-aggregated TWT Setup: multiple exchanges with counter; TWT agreement timer Neighbor Report: response timeout ≈ 100 ms SA Query: timer per 802.11w liveness probe | dot11ActionFrameTransmitted dot11RMActionFramesReceived dot11BAActionFramesReceived dot11HEActionFrameCount (vendor) | wlan.fc.type_subtype==13 | Most versatile management frame. The ADDBA (Add Block Ack) exchange lives here (Cat 3) - if ADDBA fails, A-MPDU cannot be used. Monitor ADDBA Req/Resp for aggregation setup failures. BSS Color Change Announcement (Cat 30) is broadcast as Action No Ack. |
| MGMT | 14 | 0x0E | Action No Ack | ANOA | Either | Category-dependent | No | Basic rate | Same body as Action frame - Category + Action Code + variable body. Used when no MAC-level ACK is needed or desired. | No ACK, no retry - fire-and-forget; used for BSS Color Change Announcement countdown, RRM measurement reports | dot11ActionNoAckTransmitted | wlan.fc.type_subtype==14 | Used where loss is acceptable: BSS Color Change Announcement (repeated multiple times = redundancy replaces ACK), Radio Measurement Reports, Public Action frames for GAS. Also used for channel switch announcements (CSA) during DFS events. |
| MGMT | 15 | 0x0F | Reserved | - | - | - | - | - | - | - | - | - | Not defined in current spec; discard on receipt. |
CONTROL FRAMES (Type = 01) - Medium access control, ACK, block ACK, power save | No payload, very short on-air time9 rows#
| CTRL | 8 | 0x08 | Block Ack Request | BAR | Either | No | No | Basic or HT/VHT/HE | BAR Control (2B): BAR Ack Policy, Multi-TID, Compressed, TID info; Starting Sequence Control (SSC, 2B): fragment number + seq number; (Multi-TID BAR has multiple per-TID SSCs) | Sent after burst or at end of TXOP to flush BA window; timer: if no BA received → retry up to dot11ShortRetryLimit then fallback | dot11BARTransmitted dot11BARReceivedCount dot11QoSCountersEntry.tid | wlan.fc.type_subtype==24 | BAR is used to advance the Block Ack window when receiver's bitmap has gaps - AP sends BAR to request selective re-transmission. Without periodic BAR, stale sequence numbers can stall the BA window and halt aggregation. |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CTRL | 9 | 0x09 | Block Ack | BA | Either | No | No | Basic or HT/VHT/HE | BA Control (2B): BA Ack Policy, Multi-TID, Compressed, GCR, TID info; Starting SSC (2B); Bitmap: 64-bit (HT/VHT) or 256-bit (HE/EHT) - 1 bit per in-flight MPDU | Sent SIFS after BAR or last AMPDU frame in burst; covers up to 64 MPDUs (HT/VHT) or 256 MPDUs (HE/EHT); each 0-bit → retransmission of that MPDU | dot11BATransmitted dot11QoSRetryCount (per TID) dot11QoSSuccessCount (per TID) | wlan.fc.type_subtype==25 | The 256-bit bitmap in 802.11ax allows up to 256 outstanding MPDUs per TID per BA agreement. Engineers examining PER (Packet Error Rate) inspect BA bitmaps - many 0-bits indicate poor channel or aggregation size too large for SNR. |
| CTRL | 10 | 0x0A | PS-Poll | PS-Poll | STA → AP | No | No | Basic rate | AID (with bits 15:14 = 11), BSSID, TA (STA MAC); 20-byte total frame | STA sends one PS-Poll per buffered unicast frame after DTIM; must be repeated if AP sets More Data bit in response | dot11PSPollTransmitted dot11PSPollSuccessCount | wlan.fc.type_subtype==26 | Legacy power save polling mechanism. STA wakes at DTIM, checks TIM bitmap for its AID, sends PS-Poll if AID bit set, AP sends buffered frame, STA checks More Data bit. If More Data=1, STA sends another PS-Poll. Replaced by U-APSD and TWT in modern networks. |
| CTRL | 11 | 0x0B | RTS | RTS | STA → AP (or STA→STA) | No | No | Lowest basic rate (RTS protection) | RA (4B): receiver address; TA (4B): transmitter address; Duration (2B): µs to reserve medium = SIFS + CTS_time + SIFS + DATA_time + SIFS + ACK_time | CTS timeout = SIFS + slot time + processing (~25-35 µs); if no CTS → retry; threshold: dot11RTSThreshold (default 2347 bytes, effectively off) | dot11RTSSuccessCount dot11RTSFailureCount dot11MultipleRetryCount | wlan.fc.type_subtype==27 | All STAs hearing RTS set their NAV to Duration field, deferring for that duration. Provides virtual carrier sense for hidden nodes. Only sent for frames above dot11RTSThreshold. In 802.11ax, MU-RTS is a variant sent by AP to simultaneously mute multiple STAs before UL trigger. |
| CTRL | 12 | 0x0C | CTS | CTS | Receiver of RTS | No | No | Lowest basic rate | RA (4B): echo of TA from RTS (gives transmitter clearance); Duration (2B): Duration from RTS minus RTS overhead | Sent SIFS after RTS by receiver; all hearers update NAV; no RA for CTS-to-Self (self-addressed) | dot11CTSTransmitted dot11CTSReceivedCount | wlan.fc.type_subtype==28 | CTS-to-Self: AP sends CTS with RA = its own address before sending a mixed-mode frame (e.g. legacy STA nearby). This forces all legacy STAs to defer via NAV. Slightly less overhead than RTS/CTS exchange. Also used as part of MU-RTS/CTS sequence in 802.11ax UL OFDMA. |
| CTRL | 13 | 0x0D | ACK | ACK | Receiver of unicast frame | No | No | Matched to DATA rate or basic rate | RA (4B): echo of TA of acknowledged frame; Duration (2B): 0 if last frame in TXOP, else remaining TXOP µs; 14-byte total | Sent SIFS (16 µs) after unicast DATA/MGMT; ACK timeout at TX side = SIFS + slot + processing ≈ 25-35 µs; failure → retry counter incremented; dot11ShortRetryLimit (default 7) / dot11LongRetryLimit (default 4) | dot11AckFailureCount dot11SuccessfulTransmitCount dot11RetryCount dot11MultipleRetryCount dot11FrameDuplicateCount | wlan.fc.type_subtype==29 | Every unicast frame above the ACK policy threshold expects an ACK within SIFS. Failure to receive ACK triggers retransmission with Retry bit set. Elevated dot11AckFailureCount = poor link quality or hidden node. In A-MPDU mode, Block ACK replaces individual ACKs - individual ACK only used outside aggregation. |
| CTRL | 14 | 0x0E | CF-End | CF-End | AP → All | No | No | Basic rate | RA = Broadcast, BSSID = AP BSSID, Duration = 0; resets NAV to 0 for all STAs | Ends Contention-Free Period (PCF); sets all STAs' NAV to zero | dot11CFEndCount | wlan.fc.type_subtype==30 | PCF (Point Coordination Function) is obsolete - replaced by EDCA/HCCA/OFDMA. CF-End virtually never appears in modern Wi-Fi captures. Knowledge of it is useful when parsing very old 802.11b/g captures. |
| CTRL | 15 | 0x0F | CF-End + CF-Ack | CF-End+CF-Ack | AP → All | No | No | Basic rate | Combined CF-End and CF-Ack for previous frame; PCF context only | PCF obsolete; never seen in modern networks | dot11CFEndCFAckCount | wlan.fc.type_subtype==31 | Obsolete. PCF was designed for deterministic latency but never widely implemented due to complexity and the success of EDCA (WMM). Knowing it exists matters only for parsing legacy frame captures. |
| CTRL | 2 | 0x02 | Trigger Frame (ax) | TF | AP → STAs (multi-user) | No | No | HE SU (basic HE rate) | Trigger Type (4b): 0=Basic, 1=BFRP (Beamforming Report Poll), 2=MU-BAR, 3=MU-RTS, 4=BSRP, 5=GCR-MU-BAR, 6=BQRP, 7=NFRP; Common Info (cascade bit, UL length, GI+LTF type, MU-MIMO, AP TX Power); Per User Info (AID12, RU allocation, UL MCS, UL DCM, SS allocation, Target RSSI) | STAs must respond within SIFS (16 µs) - very tight; UL response duration embedded in TF Duration field; Multi-STA BA sent after all UL transmissions | dot11TriggerFrameTransmitted dot11TriggerFrameReceived dot11ULOFDMACount (vendor) | wlan.fc.type_subtype==34 | Core of 802.11ax UL OFDMA. AP sends one TF scheduling up to 37 STAs (26-tone RUs in 80 MHz). Each scheduled STA must respond with HE TB PPDU SIFS after TF. The AID12 field is the lower 12 bits of the AID - identifies which STA owns each RU. Target RSSI in TF allows STA to power-control its UL transmission. |
| CTRL | 5 | 0x05 | NDP Announcement | NDPA | AP → STAs | No | No | Basic rate | STA Info list: AID (12b) + Feedback Type (3b) + Nc Index (3b) per scheduled STA; followed immediately by NDP frame SIFS later | Sounding sequence timer: NDPA → SIFS → NDP → SIFS → Beamforming Report Poll → SIFS → Compressed BF Feedback | dot11NDPAnnouncementTransmitted dot11BFReportPollTransmitted | wlan.fc.type_subtype==37 | NDPA precedes every NDP sounding sequence. It tells all listed STAs they will be receiving an NDP and must prepare to measure it. After NDP, AP polls each STA in turn (or uses Multi-STA sounding in ax) for their compressed feedback matrix. |
DATA FRAMES (Type = 10) - Carry MSDU payload | QoS Control field present for subtypes 8-15 | ToDS/FromDS bits set based on BSS role3 rows#
| DATA | 0 | 0x00 | Data (non-QoS) | Data | Either | No | Yes | Any negotiated rate | FC, Duration, Addr1-3 (+ Addr4 if WDS/mesh), Seq Control, MSDU body (max 2304 B), FCS (4B); no QoS Control field | Retry limit: dot11ShortRetryLimit (7) for ≤dot11RTSThreshold; dot11LongRetryLimit (4) for larger | dot11TransmittedFragmentCount dot11FailedCount dot11RetryCount | wlan.fc.type_subtype==32 | Legacy non-QoS data. No TID, no prioritisation. Still used in some legacy BSS contexts. Cannot use A-MPDU aggregation without QoS. Virtually all modern Wi-Fi uses QoS Data (subtype 8) instead. |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DATA | 4 | 0x04 | Null Function (no data) | Null | STA → AP | No | No | Basic or lowest | Frame header only; zero-length body; Power Management bit = 1 means STA going to sleep, PM = 0 means waking up | Sent before STA enters PS mode; AP must buffer unicast after receiving PM=1 Null; dot11NullFrameTransmitted | dot11NullFrameTransmitted dot11PSPowerSaveCount (vendor) | wlan.fc.type_subtype==36 | Critical for legacy power save. When PM=1, AP starts buffering unicast for this STA. When PM=0 (STA waking), AP can resume delivery. Triggers can cause PS-Poll sequence if there are buffered frames. In TWT networks, TWT SP entry/exit replaces Null frames for power control. |
| DATA | 8 | 0x08 | QoS Data | QoS Data | Either | No | Yes | Any negotiated rate | FC, Duration, Addr1-3 (+Addr4 WDS), Seq Control, QoS Control (2B): [TID 3:0][EOSP][ACK Policy 6:5][A-MSDU present][TXOP/Queue Size/AP PS Buffer State], CCMP/GCMP IV (if encrypted), MSDU or A-MSDU body, MIC (if encrypted), FCS | Per-TID sequence space (independent for each of 16 TIDs); ACK policy: 0=Normal ACK, 1=No ACK, 2=No Explicit ACK, 3=Block ACK; TXOP limit from EDCA params | dot11QoSTransmittedMPDUCount (per TID) dot11QoSSuccessCount (per TID) dot11QoSRetryCount (per TID) dot11QoSFailedCount (per TID) | wlan.fc.type_subtype==40 | The workhorse of modern Wi-Fi. TID 0-7 map to AC_BE, AC_BK, AC_BE, AC_VI, AC_VI, AC_VO, AC_VO, AC_VO. EOSP=1 signals end of U-APSD service period. A-MSDU flag indicates the body is a concatenated A-MSDU rather than a single MSDU. |
| DATA | 12 | 0x0C | QoS Null | QoS Null | Either | No | No | Basic or lowest | Header + QoS Control only; zero body; EOSP bit = 1 ends U-APSD SP; PM bit signals PS transition; TID indicates which SP is ending | EOSP=1 triggers AP to send remaining buffered frames then end SP; TWT SP end can use QoS Null with EOSP=1 | dot11QoSNullFrameTransmitted dot11USPEndCount (vendor) dot11TWTSPCount (vendor) | wlan.fc.type_subtype==44 | QoS Null is the primary mechanism to end a U-APSD service period (EOSP=1). During TWT, a QoS Null with EOSP=1 at end of SP allows the STA to return to doze state. Monitoring QoS Null rate reveals how frequently clients are toggling power save states. |
EXTENSION FRAMES (Type = 11) - 802.11ad (60 GHz DMG) and 802.11ah (Sub-1 GHz S1G) | Standard infrastructure does not use Type 31 rows#
| EXT | 0 | 0x00 | DMG Beacon | DMG BCN | PCP/AP → Broadcast (60 GHz) | No | No | MCS 0 (lowest SC PHY) | BHI (Beacon Header Interval), Timestamp, Beacon Interval, Capability Info, SSID, DMG Capabilities, DMG Operation, Extended Schedule (BTI+A-BFT+ATI periods), Sector Sweep (SSW): sector ID, CDOWN (countdown), SNR report | BTI (Beacon Transmission Interval): AP sweeps all sectors during BTI; A-BFT (Association Beamforming Training) follows BTI for STAs to perform sector sweep back; BI = BTI + A-BFT + ATI + DTI | dot11DMGBeaconTransmitted dot11SectorSweepCount dot11BFTrainingCompleted | wlan.fc.type_subtype==48 | 60 GHz requires directional beamforming - the AP cannot broadcast in all directions simultaneously. DMG Beacon includes sector sweep to cover the spatial domain. Each beacon is transmitted in one sector direction; multiple beacons cover all sectors in one BI. |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXT | 1 | 0x01 | S1G Beacon | S1G BCN | AP → Broadcast (Sub-1 GHz) | No | No | MCS 0 (BPSK 1/2 mandatory) | S1G Beacon Compatibility (timestamp, beacon interval); Change Sequence (for beacon update detection); ANO (AP Network Offset - used for sleep scheduling); Next TBTT (compressed); SSID (may be omitted for bandwidth saving); S1G Capabilities; S1G Operation; TIM/Page Slice (hierarchical TIM for large AIDs); Authentication Control; TSF Timer Accuracy | S1G beacon interval: configurable up to 1000 TU (IoT-friendly); 1 M beacon = 1 MHz channel mandatory fallback; Page Slice timer for hierarchical TIM delivery; Target Wake Time coordination | dot11S1GBeaconTransmitted dot11S1GPageSliceCount dot11S1GTWTAgreementCount | wlan.fc.type_subtype==49 | S1G Beacon is deliberately compressed vs 802.11 Beacon to save airtime. SSID is optional (STAs remember it). Hierarchical TIM (Page/Block/Subblock) extends AID space to support thousands of IoT devices. ANO allows STAs to pre-calculate next TBTT without staying awake. |
KEY 802.11 MIB COUNTERS (IEEE 802.11 SME / dot11StationConfigTable)20 rows#
| Counter Name | Object (dot11…) | Increments When… | Diagnostic Use |
|---|---|---|---|
| Transmitted Frame Count | dot11TransmittedFrameCount | Any frame successfully transmitted (ACK received or no-ACK policy) | Baseline TX activity; rate of change = STA throughput proxy |
| Failed Count | dot11FailedCount | TX fails after retry limit exceeded (no ACK, no BA bitmap success) | High value = poor link quality, range too large, or interference |
| Retry Count | dot11RetryCount | Frame transmitted after at least one retry | Combined with FailedCount gives PER estimate: PER ≈ Failed / (Success + Failed) |
| Multiple Retry Count | dot11MultipleRetryCount | Frame required more than one retry before success | Distinguishes occasional retries from sustained poor channel conditions |
| ACK Failure Count | dot11AckFailureCount | ACK not received within ACK timeout after unicast TX | Hidden node or near/far problem; should be near zero on healthy link |
| RTS Success Count | dot11RTSSuccessCount | RTS transmitted + CTS received before timeout | Confirms RTS/CTS working; low ratio RTS success = hidden node problem |
| RTS Failure Count | dot11RTSFailureCount | RTS transmitted, no CTS received within timeout | High ratio = severe hidden node or range issue |
| Duplicate Frame Count | dot11FrameDuplicateCount | Frame received with seq number matching recently received frame | Usually harmless; high counts may indicate ACK loss causing unnecessary retransmission |
| FCS Error Count | dot11FCSErrorCount | Frame received with FCS (CRC) mismatch | Direct measure of bit errors; high value = interference, multipath, or hardware issue |
| Received Fragment Count | dot11ReceivedFragmentCount | Any fragment successfully received (FCS OK) | All received frames including beacons; use to calculate receive PER |
| Multicast Received Frame Count | dot11MulticastReceivedFrameCount | Multicast/broadcast frame received | High multicast rate = busy network or excessive L2 flooding |
| Transmitted Fragment Count | dot11TransmittedFragmentCount | Fragment (or full MSDU if no fragmentation) successfully transmitted | Similar to TransmittedFrameCount at fragment level |
| Multicast Transmitted Frame Count | dot11MulticastTransmittedFrameCount | Multicast/broadcast frame transmitted by this STA | High = SSDP, mDNS, ARP flooding eating airtime |
| QoS Success Count (per TID) | dot11QoSCountersEntry.SuccessCount | QoS MPDU for this TID successfully transmitted (ACKed or BA bitmap=1) | Per-TID success tracking; low VO/VI TID success = QoS prioritisation failure |
| QoS Failed Count (per TID) | dot11QoSCountersEntry.FailedCount | QoS MPDU for this TID failed after retry limit | Per-TID failure rate; high VO TID failures = voice quality degradation |
| Disassociate Count | dot11DisassociateCount | Disassociation frame transmitted | Unexpected spikes = AP restart, load balancing, or STA misbehaviour |
| Deauthenticate Count | dot11DeauthenticateCount | Deauthentication frame transmitted | Spike = security event, 802.1X failure, or RADIUS server issue |
| Associate Failed Count | dot11AssociateFailedCount | Association Response with status ≠ 0 | RSN mismatch, capacity limit, rate mismatch; analyse status codes |
| Authenticate Failed Count | dot11AuthenticateFailedCount | Authentication fails (SAE failure, EAP reject, wrong PSK) | High = credentials issue or DragonBlood-type SAE attack attempt |
| Beacon Count | dot11BeaconCount | Beacon frame transmitted by AP | Should be steady; drops = beacon congestion or AP overload |