MAC LayerL2

STA State Machine

MAC Troubleshooting Analysis

802.11 STA State Machine - IEEE 802.11-2020 §11.3.2 | 3 States × Class 1/2/3 Frame Access Control2 rows#

1	Unauthenticated / Unassociated	Class 1 ONLY: • Beacon, Probe Req/Resp • Authentication • Announcement Traffic Indication Msg (ATIM) • Timing Advertisement • Any broadcast/multicast mgmt	• Power-on / reset • Deauthentication received (from State 2 or 3) • Auth timeout • Explicit deauth transmitted	→ State 2: Authentication frame exchange completes (Open System seq1+2 OK; SAE Commit+Confirm OK; FT Auth OK)	Class 2 frame → Deauth reason 6 Class 3 frame → Deauth reason 7	dot11AuthenticateFailedCount Check: wlan.fc.type_subtype==12 reason_code==6
2	Authenticated / Unassociated	Class 1 + Class 2: • Association Req/Resp • Reassociation Req/Resp • Disassociation • All Class 1 frames	• From State 1: Auth completes • From State 3: Disassociation received/sent • Assoc rejected (status≠0)	→ State 3: Association Response status=0 received → State 1: Deauthentication received/sent	Class 3 frame → Disassoc reason 7 (STA assoc'd elsewhere, wrong BSS)	dot11AssociateFailedCount dot11DisassociateCount wlan.fc.type_subtype==10 reason_code==7
3	Authenticated / Associated	Class 1 + 2 + 3 (all frames): • QoS Data, Null, QoS Null • Block Ack, Block Ack Req • PS-Poll, CF-End • Action (all categories) • All management frames	• From State 2: Assoc Response status=0 • Reassociation complete (roam in) • 802.11r FT reassoc complete	→ State 2: Disassociation (reason 3/4/5/8) → State 1: Deauthentication (any reason) → State 2: AP-initiated disassoc (inactivity, load)	N/A - all frame classes permitted	dot11TransmittedFrameCount dot11AckFailureCount Full data path active EAPOL 4-way follows entry to State 3

Frame Classes - IEEE 802.11-2020 Table 11-12 rows#

Class 1	All stations in any state	Mgmt: Beacon, Probe Req/Resp, Auth, Deauth, ATIM, Timing Adv Ctrl: RTS, CTS, ACK, CF-End, CF-End+CF-Ack Data: None (data frames are Class 2/3)	-	-	-	-
Class 2	Auth'd / Unassoc'd or higher	Mgmt: Assoc Req/Resp, Reassoc Req/Resp, Disassoc Ctrl: None additional Data: None	-	-	-	-
Class 3	Auth'd AND Assoc'd only	Mgmt: Action, Action No Ack, All remaining Ctrl: PS-Poll, Block Ack, Block Ack Req, Trigger, NDP Ann Data: ALL data frame subtypes (QoS Data, Null, QoS Null…)	-	-	-	-

REJECTION CODES - IEEE 802.11-2020 §11.3 Table 11-1 | Reason codes sent on wrong-class frame6 rows#

Rejection Type	Reason Code	Reason Code Name	From/To	Frame Example	Correct State	Diagnostic
Class 2 from unauth STA	Reason Code 6	Class 2 frame received from nonauthenticated STA	AP → STA (Deauth)	Assoc Req from a STA that never sent Authentication	STA must complete Auth first (State 2) before sending Class 2 frames	wlan.fc.type_subtype==12 && wlan_mgt.fixed.reason_code==6. Common cause: fast roam failure where STA sent Assoc Req without re-authenticating first.
Class 3 from unassoc STA	Reason Code 7	Class 3 frame received from nonassociated STA	AP → STA (Disassoc)	QoS Data from a STA that is authenticated but not associated	STA must also complete Association (State 3) before sending Class 3 frames	wlan.fc.type_subtype==10 && wlan_mgt.fixed.reason_code==7. Seen during roam: client sends data to new AP before completing reassociation.
Association denied (capacity)	Status Code 17	AP unable to handle additional associated STAs	AP → STA (Assoc Resp)	AP returns Status 17 in Assoc Response	AP at maximum AID limit (2007 for HT, 8191 for HE/EHT)	wlan.fc.type_subtype==1 && wlan_mgt.fixed.status_code==17. Monitor dot11AssociateFailedCount.
Association denied (rate mismatch)	Status Code 18	Requested information elements not supported	AP → STA (Assoc Resp)	STA's RSN IE AKM/cipher not supported by AP	STA must re-discover AP capabilities via Beacon/Probe and retry with compatible security	wlan_mgt.fixed.status_code==18. Most common: STA requests WPA3-SAE, AP only has WPA2.
PMF required	Status Code 31	Robust Management Frame Policy violation	AP → STA (Assoc Resp)	STA doesn't support PMF but AP has PMF required (MFPR=1)	STA must enable PMF in its RSN Capabilities before associating to PMF-required BSS	wlan_mgt.fixed.status_code==31. Required for WPA3 networks. Update driver/OS.
dot11 AID assignment	AID range: 1-2007 (legacy/HT) or 1-8191 (HE/EHT)	AID (Association Identifier) assigned in Assoc Response. Bits 15:14 = 11 in PS-Poll frame (legacy). Used in TIM bitmap for buffered multicast indication.	AP → STA (Assoc Resp)	AID in Assoc Resp: wlan_mgt.fixed.aid	AID is reused after disassociation + timeout. HE/EHT (802.11ax/be) extends AID space to 8191 for dense deployments.