The Wifi Standard is the first source of information, but it's long and incomplete.
Every 802.11 frame consists of a header, a body, and a frame check sequence (FCS). The headers vary in size, indicated by the frame control field.
802.11 Management frame format
| Offset | Size | Description |
|---|
0x00 | 2 | Frame control |
0x02 | 2 | Duration ID |
0x04 | 6 | Address 1 |
0x0A | 6 | Address 2 |
0x10 | 6 | Address 3 |
0x16 | 2 | Sequence control |
802.11 beacon header (contained in frame body)
| Offset | Size | Description |
|---|
0x00 | 8 | Time stamp |
0x08 | 2 | Broadcast Interval |
0x0A | 2 | Capabilities |
0x0C | * | Tagged Data |
There is no end-of-list marker, the tagged data ends when the packet does.
Frame control field
| 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
|---|
| Ver | Type | Subtype | To DS | From DS | Frag | Retry | PM | More | WEP | Order |
- Ver - Protocol Version (bits 1..0)
- Type (bits 2..3)
- Sub-type (bits 4..7)
- To DS (bit 8)
- From DS (bit 9)
- More Frag (bit 10)
- Retry (bit 11)
- PM - Power Management (bit 12)
- More data (bit 13)
- WEP (bit 14)
- Order (bit 15)
Type and sub-type fields
| Type | Type Desc. | Subtype | Subtype Desc. |
|---|
00 | Management | 0000 | Association request |
00 | Management | 0001 | Association response |
00 | Management | 0010 | Reassociation request |
00 | Management | 0011 | Reasociation response |
00 | Management | 0100 | Probe request |
00 | Management | 0101 | Probe response |
00 | Management | 0110 | Reserved |
00 | Management | 0111 | Reserved |
00 | Management | 1000 | Beacon |
00 | Management | 1001 | AITM |
00 | Management | 1010 | Disassociation |
00 | Management | 1011 | Authentication |
00 | Management | 1100 | Deauthentication |
00 | Management | 1101 | Reserved |
00 | Management | 1110 | Reserved |
00 | Management | 1111 | Reserved |
etc...
Look at the 802.11 pdf for more details, will add the rest here later.
Frame Check Sequence (FCS)
The FCS is the complement of a CRC-32 over the payload and header.
FCS = ~crc32(0xFFFFFFFF, packet, length);