Frame Type

CWAP – 802.11 Mgmt Frame Types 802.11 Management Frames have MAC header with 3 addresses fields in it. If it is 802.11a/b/g then it has 24 byte MAC header where as if it is 802.11n management frame it has 28 byte (additional 4 byte HT control field) MAC header as shown below (page 124-125, CWAP Official Study Guide) There are 12 management frame subtypes defined by 802.11-2007 standard shown below (page 125 – CWAP study guide). In wireshark you can use this subtype to filter those management traffic. Below shows those filters & sample of management frame for each of those subtypes. 1. Association Request

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x00)

2. Association Response

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x01)

3. Reassociation Request

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x02)

4. Reassociation Response

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x03)

5. Probe Request

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x04)

6. Probe Response

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x05)

7. Beacon

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x08)

8. Announcement Traffic Indication Message – ATIM

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x09)

9. Disasociation

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x0a)

10. Authentication

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x0b)

11. Deauthentication

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x0c)

12. Action

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x0d)

13. Action No ACK

(wlan.fc.type == 0)&&(wlan.fc.type_subtype == 0x0e)

References1. CWAP Official Study Guide – Chapter 4