| 0 | SSID | 802.11 base | Beacon, Probe Req/Resp, (Re)Assoc Req | Network name, 0-32 bytes. Length 0 = wildcard (Probe Req) or hidden SSID (Beacon). UTF-8 allowed if SSID Encoding bit set. | wlan.ssid |
| 1 | Supported Rates | 802.11 base | Beacon, Probe, Assoc | Up to 8 rates. MSB set (0x80) = basic/mandatory rate. Value = rate ÷ 500 kbps (0x82 = basic 1 Mbps). 0xFF in this IE never valid - see BSS Membership Selectors below. | wlan.supported_rates |
| 3 | DSSS Parameter Set | 802.11 base | Beacon, Probe Resp (2.4 GHz) | Current channel number for DSSS/HR-DSSS/ERP PHYs. The classic "what channel is this AP on" field in 2.4 GHz. | wlan.ds.current_channel |
| 4 | CF Parameter Set | 802.11 base | Beacon (PCF) | Contention-free period parameters. PCF obsolete - never seen in modern captures. | - |
| 5 | TIM (Traffic Indication Map) | 802.11 base | Beacon only | DTIM Count, DTIM Period, Bitmap Control, Partial Virtual Bitmap. Bit N set = AP holds buffered frames for AID N. AID 0 bit = buffered group traffic (sent after DTIM beacon). | wlan.tim.dtim_count / .dtim_period |
| 6 | IBSS Parameter Set | 802.11 base | Beacon (IBSS) | ATIM window for ad-hoc networks. | - |
| 7 | Country | 802.11d | Beacon, Probe Resp | Country string (e.g. "US "), then triplets: first channel, number of channels, max TX power. Drives client regulatory behavior (passive scan lists). | wlan.country_info |
| 11 | BSS Load (QBSS) | 802.11e | Beacon, Probe Resp | Station Count, Channel Utilization (0-255 = 0-100% of measured airtime busy), Available Admission Capacity. Key roaming/steering input - clients use it to avoid loaded APs. | wlan.qbss.cu (channel utilization) |
| 12 | EDCA Parameter Set | 802.11e | Beacon, Probe Resp, Assoc Resp | Per-AC CWmin/CWmax/AIFSN/TXOP limit the AP tells clients to use. QoS Info field includes U-APSD flag. | wlan.wfa.ie.wme / EDCA fields |
| 13 | TSPEC | 802.11e | ADDTS Action frames | Traffic specification for admission control (mean data rate, nominal MSDU size, surplus bandwidth). Used by WMM-AC / voice admission control. | wlan.ts_info |
| 14 | TCLAS | 802.11e | ADDTS / SCS | Traffic classification (frame filter) associated with a TSPEC or SCS stream. | - |
| 32 | Power Constraint | 802.11h | Beacon, Probe Resp | dB reduction from regulatory max - local max TX power = country max - constraint. | wlan.powercon.val |
| 33 | Power Capability | 802.11h | (Re)Assoc Req | Client min/max TX power capability. | - |
| 34 | TPC Request | 802.11h | Action | Requests TX power / link margin report. | - |
| 35 | TPC Report | 802.11h | Beacon, Probe Resp, Action | TX power and link margin. In beacons: shows AP TX power - useful for verifying power settings in surveys. | wlan.tpc.report.tx_power |
| 36 | Supported Channels | 802.11h | (Re)Assoc Req | Channel ranges the client supports - inspect when investigating DFS-channel client compatibility. | - |
| 37 | Channel Switch Announcement (CSA) | 802.11h | Beacon, Probe Resp, Action | New channel + switch count(down) + mode (0 = keep transmitting, 1 = stop TX until switch). Critical for DFS events. Count decrements each beacon. | wlan.csa.channel_switch_mode / .new_channel / .count |
| 38 | Measurement Request | 802.11h/k | Action | Basic / CCA / RPI / channel-load / noise-histogram / beacon / frame / STA-stats measurement requests (802.11k RRM). | wlan.rmreq |
| 39 | Measurement Report | 802.11h/k | Action | Reports for the above. Beacon Report = the key 802.11k roaming assist (client-reported neighbor RSSI). | wlan.rmrep |
| 40 | Quiet | 802.11h | Beacon | Schedules quiet interval (all STAs silent) so AP can perform radar CAC measurement. | - |
| 42 | ERP Information | 802.11g | Beacon, Probe Resp (2.4 GHz) | NonERP_Present, Use_Protection, Barker_Preamble_Mode bits. Use_Protection=1 → 802.11b protection (CTS-to-self/RTS) active - classic 2.4 GHz throughput-drop signature. | wlan.erp.use_protection |
| 45 | HT Capabilities | 802.11n | Beacon, Probe, (Re)Assoc | Client/AP HT abilities: supported MCS bitmap, 40 MHz support, SGI, SM Power Save, A-MPDU factor/density, LDPC, STBC, max A-MSDU. | wlan.ht.capabilities |
| 46 | QoS Capability | 802.11e | Assoc when no full EDCA IE | Condensed QoS Info field only. | - |
| 48 | RSN (Robust Security Network) | 802.11i | Beacon, Probe, (Re)Assoc Req | THE security IE: group cipher, pairwise cipher list, AKM list, RSN Capabilities (MFPC/MFPR = PMF bits!), PMKID list, group mgmt cipher. Mismatch here = assoc/4-way failures. See dedicated RSN sheet. | wlan.rsn.* (wlan.rsn.akms.type, wlan.rsn.pcs.type) |
| 50 | Extended Supported Rates | 802.11g | Beacon, Probe, Assoc | Rates beyond the 8 that fit in IE 1. Also carries BSS Membership Selectors (MSB set): 127 = HT PHY required, 126 = VHT PHY, 122 = HE PHY, 123 = SAE Hash-to-Element only. | wlan.extended_supported_rates |
| 51 | AP Channel Report | 802.11k | Beacon, Probe Resp | Operating class + channel list of neighboring APs - reduces client scan time. | - |
| 52 | Neighbor Report | 802.11k | Action (Neighbor Rpt Resp) | BSSID, BSSID Info, op class, channel, PHY type of neighbor APs (+ optional FT Mobility Domain subelement). Core of 802.11k-assisted roaming. | wlan.nreport |
| 54 | Mobility Domain (MDE) | 802.11r | Beacon, Probe, (Re)Assoc | MDID (2 bytes) + FT capability bits (over-DS allowed, resource request). Same MDID = fast transition possible between APs. | wlan.mobility_domain.mdid |
| 55 | Fast BSS Transition (FTE) | 802.11r | Auth (FT), (Re)Assoc | MIC, ANonce, SNonce, R0KH-ID, R1KH-ID for the FT 4-way-replacing exchange. Debug 802.11r roam failures here. | wlan.ft.* |
| 56 | Timeout Interval (TIE) | 802.11r/w | Assoc Resp, FT frames | Type 1 = reassoc deadline, type 2 = key lifetime, type 3 = SA Query retry timeout (association comeback time - seen with PMF). | wlan.timeout_interval |
| 59 | Supported Operating Classes | 802.11y/-2012 | (Re)Assoc Req | Operating classes (band+BW combos, Annex E) the client supports. How APs learn a client is 6 GHz-capable pre-association. | - |
| 60 | Extended CSA (eCSA) | 802.11y/-2012 | Beacon, Action | CSA + operating class - needed when switching bands/BW, not just channel. | wlan.ext_csa.* |
| 61 | HT Operation | 802.11n | Beacon, Probe Resp | Primary channel, secondary offset (above/below/none), HT protection mode, Basic MCS set. Where 40 MHz plan and greenfield/mixed protection is announced. | wlan.ht.info.* |
| 70 | RM Enabled Capabilities | 802.11k | Beacon, (Re)Assoc | Bitmask of which 802.11k measurements the device supports (neighbor report, beacon passive/active/table, link measurement...). Check before blaming a client for ignoring 11k. | wlan.rmcap |
| 71 | Multiple BSSID | 802.11v/ax | Beacon, Probe Resp | Advertises co-located BSSIDs (nontransmitted profiles) inside one beacon. MANDATORY concept on 6 GHz. MaxBSSID Indicator n → 2^n BSSIDs share one beacon. | wlan.mbssid.* |
| 74 | Overlapping BSS Scan Parameters | 802.11n | Beacon | Scan intervals a 40 MHz 2.4 GHz BSS asks clients to use for OBSS coexistence checks. | - |
| 76 | Management MIC (MME) | 802.11w | Broadcast Deauth/Disassoc, Beacon (opt) | BIP integrity element protecting broadcast management frames: Key ID, IPN (replay counter), MIC. Presence = PMF group protection active. | wlan.mme.* |
| 84 | SSID List | 802.11-2012 | Probe Req | Multiple SSIDs in one directed probe - reduces scan airtime. | - |
| 107 | Interworking | 802.11u | Beacon, Probe, Assoc | Access Network Type (private/free-public/chargeable...), Internet bit, Venue Info, HESSID. Hotspot 2.0 / Passpoint foundation. | wlan.interworking.* |
| 108 | Advertisement Protocol | 802.11u | Beacon, Probe Resp | Advertises ANQP (and other query protocols) supported - enables pre-association GAS/ANQP queries. | - |
| 111 | Roaming Consortium | 802.11u | Beacon, Probe Resp | OI (Organization Identifiers) of roaming federations - Passpoint clients match against installed credentials. | wlan.rcons.* |
| 113 | Mesh Configuration | 802.11s | Mesh Beacon | Path selection protocol (HWMP), metric, congestion control, mesh formation info. | wlan.mesh.config.* |
| 114 | Mesh ID | 802.11s | Mesh Beacon, Probe | Mesh network name (analog of SSID for mesh BSS). | wlan.mesh.id |
| 127 | Extended Capabilities | 802.11-2012+ | Beacon, Probe, Assoc | Grab-bag capability bitmap: bit 19 = BSS Transition (11v BTM!), bit 12 = proxy ARP, bit 31 = Interworking, bit 72 = FILS Capability, bits 77/78 = TWT Requester/Responder. First place to check "does this client support 11v". | wlan.extcap (bit 19 = BTM) |
| 133 | CCX / Cisco proprietary range | Vendor | Beacon, Assoc | IDs 133/136/149/150 etc. historically used by Cisco CCX (Aironet). Seen in captures on Cisco WLANs. | wlan.cisco.ccx1 |
| 148 | DMG Capabilities (60 GHz) | 802.11ad | DMG frames | 60 GHz capability advertisement. | - |
| 191 | VHT Capabilities | 802.11ac | Beacon, Probe, Assoc | Max MPDU length, supported channel width set (160/80+80), RX/TX VHT-MCS maps per NSS, SU/MU beamformer/beamformee caps, max A-MPDU exponent. | wlan.vht.capabilities |
| 192 | VHT Operation | 802.11ac | Beacon, Probe Resp | Channel width (0=20/40, 1=80/160/80+80), Channel Center Segment 0/1, Basic VHT-MCS set. Segment1 ≠ 0 with width 1 = 160 or 80+80 in use. | wlan.vht.op.* |
| 193 | Extended BSS Load | 802.11ac | Beacon | MU-MIMO capable STA count + spatial-stream underutilization - richer load signal than IE 11. | - |
| 194 | Wide Bandwidth Channel Switch | 802.11ac | Beacon (with CSA), Action | New channel width + segments for CSA to 80/160 MHz targets. | - |
| 195 | Transmit Power Envelope | 802.11ac/ax | Beacon, Probe Resp | Max TX power per BW (20/40/80/160). On 6 GHz carries LPI vs SP power sets - key for AFC/6 GHz debugging. | wlan.tpe.* |
| 197 | AID | 802.11ac | Assoc Resp (VHT) | Association ID container in VHT association. | - |
| 199 | Operating Mode Notification | 802.11ac | Action, Assoc | Client dynamically signals current max BW / NSS (e.g. drops to 1SS 20 MHz to save power). Explains "client stuck at low rate" mysteries. | wlan.opmode.* |
| 201 | Reduced Neighbor Report (RNR) | 802.11ax | Beacon, Probe Resp (2.4/5 GHz) | TBTT info of co-located APs - THE out-of-band 6 GHz discovery mechanism: 2.4/5 GHz beacons advertise the 6 GHz BSS (op class, channel, short-SSID, BSSID, 20 MHz PSD). | wlan.rnr.* |
| 216 | Target Wake Time (TWT) | 802.11ah/ax | Beacon, Action | Broadcast TWT schedules; individual TWT negotiated via Action frames. See Power Save & TWT sheet. | wlan.twt.* |
| 221 | Vendor Specific | 802.11 base | Everywhere | OUI + vendor payload. Carries WPA1 (OUI 00:50:F2 type 1), WMM/WME (00:50:F2 type 2), WPS (00:50:F2 type 4), Hotspot 2.0 (50:6F:9A type 0x10), P2P, Apple/Aruba/Cisco extensions. Multiple instances per frame normal. | wlan.tag.oui |
| 244 | RSN Extension (RSNXE) | 802.11-2020/WPA3 | Beacon, Probe, Assoc, (M2/M3) | Extended RSN capability bits: bit 4 = SAE Hash-to-Element (H2E), bit 5/6 = SAE-PK. WPA3 6 GHz REQUIRES H2E. RSNXE must also be echoed inside EAPOL M2/M3 - mismatch drops the 4-way. | wlan.rsnx.* |
| 255 | Element ID Extension | 802.11ax+ | Everywhere | Escape code: real ID = 255 + Extension ID byte that follows. All HE/EHT elements live here (below). | wlan.ext_tag.number |