MAC LayerL2

MAC Header Anatomy

MAC Analysis Reference

FRAME CONTROL FIELD - bit by bit (first 2 bytes of every 802.11 frame) - IEEE 802.11-2020 §9.2.4.111 rows#

Subfield	Bits	Meaning	Analysis Notes
Protocol Version	B0-B1	Always 00 (version 0). Value 01 reserved for future.	Wireshark: wlan.fc.version. Non-zero = corruption/capture artifact.
Type	B2-B3	00=Management, 01=Control, 10=Data, 11=Extension.	wlan.fc.type
Subtype	B4-B7	Frame subtype - see 802.11 Frame Types sheet for all values.	wlan.fc.type_subtype combines both.
To DS	B8	1 = frame destined to the Distribution System (client→AP direction for infrastructure data).	See address table below - ToDS/FromDS decide Addr1-4 meaning.
From DS	B9	1 = frame exiting DS (AP→client). Management/control frames: both bits 0.	ToDS=FromDS=1 → 4-address (WDS/mesh) frame.
More Fragments	B10	1 = more fragments of this MSDU follow.	Fragmentation nearly extinct in modern nets (A-MPDU replaced it); HE adds dynamic fragmentation inside A-MPDU.
Retry	B11	1 = retransmission of an earlier frame.	wlan.fc.retry==1 rate = quick PER proxy in captures. >10-15% sustained = investigate.
Power Management	B12	1 = STA will be in power-save after this exchange.	Watch Null frames toggling this bit - legacy PS signaling (see Power Save sheet).
More Data	B13	1 = AP holds more buffered frames for this PS STA.	AP→STA only meaningfully.
Protected Frame	B14	1 = frame body encrypted (WEP/TKIP/CCMP/GCMP).	Set on Data and on PMF-protected unicast Management frames.
+HTC / Order	B15	Legacy: strictly-ordered service. Modern (QoS frames): 1 = HT Control field present in header.	HE uses it for A-Control (OM, BSR...). See HT Control rows below.

ADDRESS FIELDS vs ToDS/FromDS - IEEE 802.11-2020 Table 9-30 | RA=Receiver TA=Transmitter DA=Destination SA=Source4 rows#

ToDS/FromDS	Scenario	Address 1	Address 2	Address 3	Address 4	Notes
ToDS=0 FromDS=0	IBSS / mgmt / ctrl	Addr1 = RA = DA	Addr2 = TA = SA	Addr3 = BSSID	-	Beacons, probes, auth, ad-hoc data.
ToDS=1 FromDS=0	Client → AP	Addr1 = RA = BSSID	Addr2 = TA = SA (client)	Addr3 = DA (final dest)	-	Uplink data. DA may be wired host beyond AP.
ToDS=0 FromDS=1	AP → Client	Addr1 = RA = DA (client)	Addr2 = TA = BSSID	Addr3 = SA (original source)	-	Downlink data. SA may be wired host.
ToDS=1 FromDS=1	WDS / Mesh / 4-addr	Addr1 = RA (next-hop rx)	Addr2 = TA (this-hop tx)	Addr3 = DA	Addr4 = SA	Bridge links, mesh backhaul, some MLO/EasyMesh backhaul.

REMAINING MAC HEADER FIELDS - IEEE 802.11-2020 §9.2.48 rows#

Field	Size	Content	Analysis Notes
Duration/ID	16 bits	Microseconds of medium reservation (NAV) remaining AFTER this frame - receivers set their NAV timer to it. In PS-Poll instead carries AID (bits 15:14 = 11).	Bad Duration values (e.g. 32767 stuck) = NAV attack or buggy driver → "air is idle but nobody transmits" symptoms.
Sequence Control	16 bits	Fragment Number (4 b) + Sequence Number (12 b, 0-4095, modulo). QoS data: independent sequence counter PER TID; mgmt frames use their own counter.	Duplicate detection: same (TA, TID, seq) with Retry=1 → dup. Sequence gaps per TID in captures = loss between capture point and TA.
QoS Control (QoS Data)	16 bits	TID (4 b, 0-7 = UP), EOSP (end of service period, U-APSD), Ack Policy (2 b: 00=Normal ACK, 01=No ACK, 10=No explicit / PSMP, 11=Block ACK), A-MSDU Present (1 b), TXOP/queue info (8 b).	Ack Policy=11 + no BA session established = silent loss. A-MSDU bit tells you the payload is an aggregate of MSDUs.
HT Control (+HTC)	32 bits	Present when Order/+HTC bit set on QoS/mgmt frame. Three variants: HT (link adaptation, antenna sel), VHT (B0=0,B1=1: MFB/MRQ beamforming feedback), HE (B0=B1=1: A-Control).	-
HE A-Control subfields	var	Aggregated control IDs inside HE variant HT Control: OM (Operating Mode - live NSS/BW change), BSR (Buffer Status Report - feeds UL OFDMA scheduler), UPH (UL power headroom), BQR (bandwidth query), CAS.	OM Control is how 11ax clients instantly signal "I dropped to 1×1 20 MHz" - faster than IE 199.
Frame Body	0-11,454 B	MSDU / A-MSDU (encrypted adds CCMP/GCMP header 8 B + MIC 8/16 B) or management fixed fields + IEs.	Max body sizes per gen: see Aggregation & Block Ack sheet.
FCS	32 bits	CRC-32 over header+body.	wlan.fcs.status == "Bad" - only trustworthy in monitor-mode captures that preserve FCS.
Header sizes	Data (3-addr): 24 B. QoS Data: 26 B. QoS +HTC: 30 B. 4-address QoS: 32 B. Add encryption header: CCMP-128 +8 B (+8 MIC), GCMP-256 +8 B (+16 MIC).