All Layer 2 frames consist of a header, payload, and FCS section as shown in Figure 1. The 802.11 frame format is similar to the Ethernet frame format, with the exception that it contains more fields.
As shown in Figure 2, all 802.11 wireless frames contain the following fields:
- Frame Control - Identifies the type of wireless frame and contains subfields for protocol version, frame type, address type, power management, and security settings.
- Duration - Typically used to indicate the remaining duration needed to receive the next frame transmission.
- Address1 - Usually contains the MAC address of the receiving wireless device or AP.
- Address2 - Usually contains the MAC address of the transmitting wireless device or AP.
- Address3 - Sometimes contains the MAC address of the destination, such as the router interface (default gateway) to which the AP is attached.
- Sequence Control - Contains the Sequence Number and the Fragment Number subfields. The Sequence Number indicates the sequence number of each frame. The Fragment Number indicates the number of each frame sent of a fragmented frame.
- Address4 - Usually missing because it is used only in ad hoc mode.
- Payload - Contains the data for transmission.
- FCS - Frame Check Sequence; used for Layer 2 error control.
Figure 3 displays a Wireshark capture of a WLAN beacon frame. Notice how the Frame Control field has also been expanded to display its subfields.
Note: The content of the Address fields vary depending on settings in the Frame Control field.