Management frames are used exclusively to find, authenticate, and associate with an AP.
Figure 1 displays the field value of common management frames including:
- Association request frame - (0x00) Sent from a wireless client, it enables the AP to allocate resources and synchronize. The frame carries information about the wireless connection including supported data rates and SSID of the network to the wireless client that wants to associate. If the request is accepted, the AP reserves memory and establishes an association ID for the device.
- Association response frame - (0x01) Sent from an AP to a wireless client containing the acceptance or rejection to an association request. If it is an acceptance, the frame contains information, such as an association ID and supported data rates.
- Reassociation request frame - (0x02) A device sends a reassociation request when it drops from range of the currently associated AP and finds another AP with a stronger signal. The new AP coordinates the forwarding of any information that may still be contained in the buffer of the previous AP.
- Reassociation response frame - (0x03) Sent from an AP containing the acceptance or rejection to a device reassociation request frame. The frame includes information required for association, such as the association ID and supported data rates.
- Probe request frame - (0x04) Sent from a wireless client when it requires information from another wireless client.
- Probe response frame - (0x05) Sent from an AP containing capability information, such as the supported data rates, after receiving a probe request frame.
- Beacon frame - (0x08) Sent periodically from an AP to announce its presence and provide the SSID and other preconfigured parameters.
- Disassociation frame - (0x0A) Sent from a device wanting to terminate a connection. Allows the AP to relinquish memory allocation and remove the device from the association table.
- Authentication frame - (0x0B) The sending device sends an authentication frame to the AP containing its identity.
- Deauthentication frame - (0x0C) Sent from a wireless client wanting to terminate connection from another wireless client.
Beacons are the only management frame that may regularly be broadcast by an AP. All other probing, authentication, and association frames are used only during the association (or reassociation) process.
Figure 2 displays a sample Wireshark screen capture of a management frame. The field values change to reflect the purpose of the frame.
Note: The example provided was captured using Wireshark. However, Wireshark must be specifically configured to capture WLAN traffic. The ability to capture traffic varies between operating systems and may require a special wireless NIC.