Techzone/WiFi Frame Body Field

WiFi Frame Body Field

3 min readArticle

The Frame Body is the variable-length payload section of an 802.11 frame. It sits after the fixed-length MAC header and before the Frame Check Sequence (FCS). Its contents depend entirely on the frame type and subtype.

Position in the 802.11 Frame Structure

shell 
[ Frame Control (2B) ][ Duration (2B) ][ Addr1 (6B) ][ Addr2 (6B) ][ Addr3 (6B) ]
[ Sequence Control (2B) ][ Addr4 (6B, optional) ][ QoS Control (2B, optional) ]
[ HT Control (4B, optional) ]
[ FRAME BODY (variable) ]
[ FCS (4B) ]

Length: 0 to 2304 bytes for standard frames (can be larger with MSDU aggregation in 802.11n+).

What the Frame Body Contains by Frame Type

Management Frames

Management frames carry Information Elements (IEs) — tagged parameters with Type-Length-Value (TLV) encoding.

Frame Subtype Body Contains
Beacon SSID, Supported Rates, DS Parameter Set, RSN (WPA2), capabilities, TIM element
Probe Request SSID (or wildcard), Supported Rates, HT/VHT capabilities
Probe Response Same as Beacon
Association Request Capability, Listen Interval, SSID, Supported Rates
Deauthentication Reason Code (2 bytes) — only field, e.g., 0x0003 = "STA leaving"
Disassociation Reason Code (2 bytes)
Authentication Auth Algorithm, Sequence Number, Status Code

Deauth Frame Body (Security Critical)

shell 
Deauth Frame Body:
  Reason Code: 2 bytes (little-endian)
  Common codes:
    0x0001 = Unspecified
    0x0002 = Previous auth no longer valid
    0x0003 = Deauthed because STA is leaving
    0x0007 = Class 3 frame received from nonassociated STA

The ESP8266 deauth attack crafts a deauth frame with reason code 0x0001 or 0x0003 in the body. That's literally all it takes — 2 bytes in the frame body plus a spoofed AP BSSID in the header.

Data Frames

The body carries the MSDU (MAC Service Data Unit) — the actual payload being transmitted. For encrypted networks:

  • WEP: Body is IV (3B) + Key ID (1B) + encrypted MPDU + ICV (4B)
  • TKIP/WPA: Body has TKIP header + encrypted data + MIC + ICV
  • CCMP/WPA2: Body has CCMP header (8B) + encrypted data + MIC (8B)

Control Frames

Most control frames have no body (ACK, RTS, CTS are header-only). Block ACK has a bitmap in its body.

Information Element (IE) Format

All IEs in management frame bodies follow this structure:

shell 
[ Tag Number (1B) ][ Tag Length (1B) ][ Tag Data (variable) ]

Example — SSID IE:

shell 
Tag: 0x00 (SSID)
Length: 0x0A (10 bytes)
Data: 4d 79 4e 65 74 77 6f 72 6b  ("MyNetwork")

Security Relevance

  1. Deauth/Disassoc attacks — the body only needs a valid reason code. No authentication or encryption required for management frames without 802.11w (PMF).
  2. Evil twin detection — inspect beacon body IEs; a rogue AP spoofing an SSID may differ in supported rates, RSN IE contents, or vendor-specific IEs (tag 0xDD).
  3. WPA2 cracking surface — the body of EAPOL frames (carried in data frames) contains the 4-way handshake material. PMKID is found in the first EAPOL message body.
  4. Covert channels — unused IE tag numbers and padding bytes within frame bodies have been used to tunnel data covertly.

Inspecting Frame Bodies with Wireshark

shell 
# Capture and open in Wireshark
airodump-ng wlan0mon -w capture
wireshark capture-01.cap

# Wireshark filter to see deauth reason codes
wlan.fc.type_subtype == 0x000c

# Filter for a specific reason code in body
wlan.fixed.reason_code == 3

# Inspect beacon IEs
wlan.fc.type_subtype == 0x0008

Reference

techzonesite.comUnlock Your IT Potential