The Frame Control field contains multiple subfields as shown in Figure 1.
Specifically, the Frame Control field contains the following subfields:
- Protocol Version - Provides the current version of the 802.11 protocol used. Receiving devices use this value to determine if the version of the protocol of the received frame is supported.
- Frame Type and Frame Subtype - Determines the function of the frame. A wireless frame can either be a control frame, data frame, or a management frame. There are multiple subtype fields for each frame type. Each subtype determines the specific function to perform for its associated frame type.
- ToDS and FromDS - Indicates whether the frame is going to or exiting from the DS, and is only used in data frames of wireless clients associated with an AP.
- More Fragments - Indicates whether more fragments of the frame, either data or management type, are to follow.
- Retry - Indicates whether or not the frame, for either data or management frame types, is being retransmitted.
- Power Management - Indicates whether the sending device is in active mode or power-save mode.
- More Data - Indicates to a device in power-save mode that the AP has more frames to send. It is also used for APs to indicate that additional broadcast/multicast frames are to follow.
- Security - Indicates whether encryption and authentication are used in the frame. It can be set for all data frames and management frames, which have the subtype set to authentication.
- Reserved - Can indicate that all received data frames must be processed in order.
Figure 2 displays a Wireshark capture of a WLAN beacon frame. Notice that the Frame Type field and the Frame Subtype fields identify if the frame is a management frame, a control frame, or a data frame. In the example, the Frame Type is ‘0x0’ identifying it as a management frame. The subtype value ‘8’ identifies this as a beacon frame. The frame is specifically identified as ‘0x08’.