Techzone/WiFi Frame HT Control Field

WiFi Frame HT Control Field

3 min readArticle

The HT Control field is an optional 4-byte (32-bit) field appended to the 802.11 MAC header in 802.11n (HT) and later (802.11ac/VHT, 802.11ax/HE) frames. Its presence is indicated by the +HTC bit in the Frame Control field.

Position in the Frame

shell 
[ Frame Control (2B) ]
  └─ bit 14: +HTC/Order flag — set to 1 if HT Control field is present
[ Duration (2B) ]
[ Addr1 ][ Addr2 ][ Addr3 ]
[ Sequence Control (2B) ]
[ Addr4 (optional) ]
[ QoS Control (2B, if QoS frame) ]
[ HT Control (4B)  <-- HERE, only if +HTC bit set ]
[ Frame Body ]
[ FCS (4B) ]

Size: 0 or 4 bytes. Only present in QoS Data, QoS Management, and some control frames.

HT Control Field Structure (802.11n)

shell 
Bit  0:     VHT — set to 1 if this is a VHT (802.11ac) Control field variant
Bits 1:     HT/VHT variant flag
Bits 2-3:   TRQ — Transmit Power Control (TPC) Report/Query bits
Bit  4:     MAI_MRQ — MCS Request / Feedback Request
Bits 5-8:   MAI / MSI — MCS request or antenna selection index
Bits 9-11:  MFSI — MCS Feedback Sequence Index
Bits 12-14: MFB / ASEL — MCS Feedback or Antenna Selection
Bit  15:    AC Constraint
Bit  16:    RDG/More PPDU
Bits 17-29: Reserved (set to 0)
Bits 30-31: NDP Announcement / RSP Indication

For 802.11ac (VHT) the field is repurposed for VHT MU-MIMO feedback and compressed beamforming.

What It Does in Practice

Link Adaptation (TRQ/MFB)

The primary purpose is link adaptation — allowing a receiver to feed back information about channel quality so the transmitter can pick a better MCS (Modulation and Coding Scheme). This improves throughput without requiring a separate management frame exchange.

  • Transmitter sets MRQ=1 (requesting feedback) in an outgoing data frame
  • Receiver replies with MFB bits indicating the best MCS it decoded
  • Transmitter adjusts rate accordingly

Transmit Power Control (TRQ)

The TPC Report/Query bits allow stations to negotiate transmission power levels. Useful in environments where reducing power reduces interference (802.11h compliance in 5 GHz).

NDP Announcement

In 802.11ac beamforming, the HT Control field announces that a Null Data Packet (NDP) follows. The NDP carries sounding information for channel estimation so the AP can form a directed beam toward the client.

Security Relevance

Fingerprinting

The presence, absence, and specific bit patterns in the HT Control field can fingerprint driver/firmware implementations:

  • Some drivers always include the field even when not needed
  • Incorrect reserved bit handling (non-zero reserved bits) reveals specific chipsets
  • Tools like p0f (network-layer) and WiFi fingerprinting scripts look for HT Control anomalies

Injection Detection

When crafting raw 802.11 frames for attacks (deauth floods, probe injection), most attack tools (aireplay-ng, ESP8266 deauth sketches) do not include the HT Control field. Real 802.11n devices on QoS data streams will include it. A WIDS can use absence of HT Control where it's expected as an injection indicator.

Reserved Bit Abuse

Bits 17-29 are reserved and must be set to zero per the standard. Setting non-zero values in reserved bits of the HT Control field can:

  • Create covert channels (29 reserved bits = 3.6 bytes of hidden data per frame)
  • Cause driver confusion on some chipsets (potential crash/DoS on vulnerable drivers)

Inspecting HT Control in Wireshark

shell 
# Filter for frames with HT Control present (+HTC bit set in Frame Control)
wlan.fc.order == 1

# Display HT Control field breakdown
# Expand: IEEE 802.11 > HT Control Field in packet detail pane

# Check for non-zero reserved bits (anomaly detection)
# No direct Wireshark filter — use tshark:
tshark -r capture.pcap -Y "wlan.fc.order==1" -T fields \
  -e wlan.htc -e wlan.sa -e wlan.da

Generating Frames with HT Control (Scapy)

python 
from scapy.all import *
from scapy.layers.dot11 import *

# HT Control is included when Dot11QoS has the order bit set
# In Scapy, craft with RadioTap + Dot11 + raw HT control bytes
frame = RadioTap() / Dot11(type=2, subtype=8) / Raw(b'\x00\x00\x00\x00')  # 4B HT Control

Reference

techzonesite.comUnlock Your IT Potential