4.3 802.11 PHY & MAC Layer Protocols, Modulation & Frame Formats

4.3 802.11 PHY & MAC Layer Protocols, Modulation & Frame Formats

Quick Answer: The 802.11 Physical (PHY) layer translates digital data bits into analog radio frequency waveforms using digital modulation schemes ranging from robust BPSK (1 bit/symbol) up to ultra-dense 4096-QAM (12 bits/symbol) in Wi-Fi 7. 802.11ax/be retain single-user OFDM and add OFDMA, which can subdivide a channel into Resource Units (RUs) for scheduled multi-user transmissions. Wi-Fi 7 introduces Multi-Link Operation (MLO) so a device can operate over multiple affiliated links; simultaneous transmit/receive capability depends on whether the negotiated mode is STR, NSTR, or a single-radio mode such as EMLSR. At the MAC layer, 802.11 frames are classified into Management, Control, and Data types, utilizing a dynamic four-address field matrix governed by the To DS and From DS bits in the Frame Control header.

---

Digital Modulation Evolution: BPSK to 4096-QAM & EVM Physics

Wireless communications convey binary ones and zeros across open space by systematically varying the amplitude, frequency, or phase of a sinusoidal RF carrier wave. Modern 802.11 systems employ Quadrature Amplitude Modulation (QAM), which simultaneously modulates both the phase and the amplitude of two orthogonal carrier waves: the In-Phase (I) component and the Quadrature (Q) component.

Bit Encoding Across Constellation Diagrams

A constellation diagram plots the allowable signal states in a two-dimensional complex plane (I versus Q). The total number of unique constellation points (M) determines how many binary bits (N) can be transmitted within each modulation symbol:

N = log2(M)

  BPSK (1 bit/sym)         QPSK (2 bits/sym)          16-QAM (4 bits/sym)         4096-QAM (12 bits/sym)
        Q                        Q                           Q                           Q
        │                        │   •   │   •               │ •  •  •  •                │ ••••••••••••••••
        │                        │       │                   │ •  •  •  •                │ ••••••••••••••••
   •────┼────•   I          ─────┼───────┼─────  I      ─────┼───────────  I        ─────┼───────────────── I
        │                        │       │                   │ •  •  •  •                │ ••••••••••••••••
        │                        │   •   │   •               │ •  •  •  •                │ ••••••••••••••••
    2 points                 4 points                    16 points                   4096 points

• BPSK (Binary Phase Shift Keying): 2 constellation points ($2^1$). Encodes 1 bit per symbol. Extremely robust against noise, used for preambles, control frames, and lowest-rate fallback.
• QPSK (Quadrature Phase Shift Keying): 4 constellation points ($2^2$). Encodes 2 bits per symbol.
• 16-QAM: 16 constellation points ($2^4$). Encodes 4 bits per symbol.
• 64-QAM: 64 constellation points ($2^6$). Encodes 6 bits per symbol (standard peak modulation for 802.11a/g/n).
• 256-QAM: 256 constellation points ($2^8$). Encodes 8 bits per symbol (introduced in 802.11ac, a 33% throughput improvement over 64-QAM).
• 1024-QAM: 1024 constellation points ($2^{10}$). Encodes 10 bits per symbol (introduced in 802.11ax, a 25% throughput improvement over 256-QAM).
• 4096-QAM (4K-QAM): 4096 constellation points ($2^{12}$). Encodes 12 bits per symbol (introduced in 802.11be / Wi-Fi 7).

The Mathematical Gain of 4096-QAM

Comparing 4096-QAM (12 bits/symbol) against 1024-QAM (10 bits/symbol) demonstrates the raw physical throughput improvement:

Throughput Improvement = (12 - 10) / 10 = 2 / 10 = +20%

4096-QAM yields a theoretical 20% increase in peak physical data rate under identical channel bandwidths and spatial stream counts.

Error Vector Magnitude (EVM) & SNR Thresholds

In a 4096-QAM constellation, 4096 discrete target points are packed tightly within the same normalized signal space. The slightest phase jitter, amplifier non-linearity, or thermal noise displaces the received symbol into an adjacent decision boundary, corrupting the packet.

To quantify modulation precision, the IEEE defines Error Vector Magnitude (EVM)—the ratio (in dB) of the error vector between the ideal constellation point and the actual received symbol point:

$\text{EVM (dB)} = 10 \log_{10}\left(\frac{P_{\text{error}}}{P_{\text{reference}}}\right)$

• 64-QAM EVM Requirement: -25 dB (requires ~20 dB SNR).
• 256-QAM EVM Requirement: -32 dB (requires ~28 dB SNR).
• 1024-QAM EVM Requirement: -35 dB (requires ~32 dB SNR).
• 4096-QAM EVM Requirement: -38 dB. The effective SINR needed in practice is very high and depends on implementation, channel estimation, interference, and measurement method; do not treat one SNR number as a universal decode boundary.

Because an SNR of 35+ dB is rarely encountered beyond a few meters from an access point, 4096-QAM operates almost exclusively in short-range line-of-sight conditions (such as desktop workstations directly beneath an AP or low-power wireless docking stations).

Digital Modulation & EVM Comparison Table

---

OFDM vs. OFDMA & Resource Unit (RU) Allocation Mechanics

A major Wi-Fi 6/7 enhancement is adding Orthogonal Frequency Division Multiple Access (OFDMA) to the existing single-user Orthogonal Frequency Division Multiplexing (OFDM) toolkit.

Legacy OFDM (802.11a/g/n/ac) - Single User Time Division:
Channel Bandwidth
▲
│ ┌─────────────────────────────────────────────────────────────┐
│ │ Frame 1: User A (Consumes 100% of channel bandwidth)        │
│ └─────────────────────────────────────────────────────────────┘
│ ┌─────────────────────────────────────────────────────────────┐
│ │ Frame 2: User B (Consumes 100% of channel bandwidth)        │
│ └─────────────────────────────────────────────────────────────┘
└─────────────────────────────────────────────────────────────────► Time

OFDMA (802.11ax/be) - Multi-User Frequency & Time Division:
Channel Bandwidth
▲
│ ┌──────────────┬──────────────┬──────────────┬──────────────┐
│ │ User A (RU)  │ User B (RU)  │ User C (RU)  │ User D (RU)  │
│ ├──────────────┼──────────────┼──────────────┼──────────────┤
│ │ User E (RU)  │ User F (RU)  │ User G (RU)  │ User H (RU)  │
│ └──────────────┴──────────────┴──────────────┴──────────────┘
└─────────────────────────────────────────────────────────────────► Time

Subcarrier Spacing & Symbol Duration Physics

In legacy OFDM (802.11a/g/n/ac), a 20 MHz channel consists of 64 subcarriers spaced 312.5 kHz apart (20 MHz / 64 = 312.5 kHz). The base symbol duration is 3.2 µs, paired with a standard 0.8 µs Guard Interval (GI) for a total symbol time of 4.0 µs.

In 802.11ax/be OFDMA, the subcarrier spacing is narrowed by a factor of four to 78.125 kHz (312.5 kHz / 4 = 78.125 kHz). Consequently, a 20 MHz channel contains 256 subcarriers (4 times as many subcarriers as OFDM). Because symbol duration is the mathematical inverse of subcarrier spacing ($T_{\text{sym}} = 1 / \Delta f$):

$T_{\text{sym}} = \frac{1}{78.125 \text{ kHz}} = 12.8 \,\mu\text{s}$

The base symbol duration expands fourfold to 12.8 µs. Combined with configurable Guard Intervals (0.8 µs, 1.6 µs, or 3.2 µs), the total symbol time reaches 13.6 µs, 14.4 µs, or 16.0 µs.

Delay Spread Resilience: A longer symbol duration (12.8 µs) makes OFDMA vastly more resilient to multipath delay spread. In large outdoor stadiums, warehouse aisles, or multi-story buildings where reflected signals travel along lengthy indirect paths, the 3.2 µs Guard Interval ensures reflections arrive before the symbol closes, preventing Inter-Symbol Interference (ISI).

OFDM vs. OFDMA Architecture Comparison Table

Resource Unit (RU) Hierarchy & Concurrency

OFDMA divides the 256 subcarriers of a 20 MHz channel into granular transmission slices called Resource Units (RUs):

• 26-tone RU: Uses 26 subcarriers (~2 MHz wide). Allows up to 9 simultaneous clients inside a single 20 MHz channel. Ideal for IoT telemetry, VoIP packets, and DNS queries.
• 52-tone RU: Uses 52 subcarriers (~4 MHz wide). Supports up to 4 simultaneous clients per 20 MHz channel.
• 106-tone RU: Uses 106 subcarriers (~8 MHz wide). Supports up to 2 simultaneous clients per 20 MHz channel.
• 242-tone RU: Uses 242 subcarriers (~20 MHz wide). Encompasses the entire 20 MHz channel for a single user.
• 484-tone RU: Spans an entire 40 MHz channel.
• 996-tone RU: Spans an entire 80 MHz channel.
• 2x996-tone RU: Spans an entire 160 MHz channel.

Multi-User Uplink OFDMA & Trigger Frames

While Downlink OFDMA allows the AP to broadcast multiple data streams to multiple clients simultaneously, Uplink MU-OFDMA requires multiple independent client stations to transmit concurrently across their assigned RUs. Because clients are physically dispersed at varying distances, their signals must arrive at the AP receiver simultaneously in time, aligned in frequency, and balanced in power.

To orchestrate this, the AP transmits an 802.11 Trigger Frame (Control Frame Subtype 0010):

1. The Trigger Frame designates the specific Association IDs (AIDs) of the participating client stations.
2. It assigns specific RU allocations (e.g., Client A on RU 1, Client B on RU 2).
3. It specifies the precise Target RSSI at which each client's signal must arrive at the AP. Clients dynamically adjust their uplink transmit power so near and far clients do not drown each other out (mitigating the near-far effect).
4. Following a Short Interframe Space (SIFS), all assigned clients transmit their High Efficiency Trigger-Based (HE TB) PPDUs in absolute synchronization.
5. The AP replies with a single Multi-STA BlockAck (M-BA) acknowledging receipt across all client sessions.

Multi-User MIMO (MU-MIMO) Mechanics

In addition to OFDMA (frequency-division multiplexing), modern Wi-Fi deploys Multi-User Multiple-Input Multiple-Output (MU-MIMO) (spatial-division multiplexing):

• Downlink MU-MIMO: Introduced in 802.11ac Wave 2 (up to 4 clients) and expanded in 802.11ax (up to 8 spatial streams) and 802.11be (up to 16 spatial streams). The AP utilizes explicit channel sounding (NDP and Compressed Beamforming Reports) to calculate precoding steering matrices, directing distinct spatial beams to independent clients simultaneously on the same frequency.
• Uplink MU-MIMO: Introduced in 802.11ax, synchronized by AP Trigger Frames. Multiple clients transmit full-bandwidth spatial streams to the AP concurrently, where the AP's multi-antenna receiver separates them via complex matrix inversion.

---

Channel Bonding Dynamics & Preamble Puncturing

Channel bonding aggregates adjacent 20 MHz channels into wider transmission conduits to increase data throughput:

• 20 MHz: Baseline channel carrying Beacons, Association, and Management frames.
• 40 MHz: Bonds Primary 20 MHz + Secondary 20 MHz.
• 80 MHz: Bonds Primary 40 MHz + Secondary 40 MHz.
• 160 MHz: Bonds Primary 80 MHz + Secondary 80 MHz.
• 320 MHz: Introduced in Wi-Fi 7 (802.11be), bonding two 160 MHz channels in 6 GHz.

Clear Channel Assessment (CCA) on Bonded Channels

Before transmitting across a bonded channel, an 802.11 radio executes Clear Channel Assessment (CCA):

• On the Primary 20 MHz channel, the radio performs standard CSMA/CA contention, sensing preamble energy down to -82 dBm (Preamble Detect) and non-Wi-Fi energy down to -62 dBm (Energy Detect).
• On the Secondary channels (Secondary 20, Secondary 40, Secondary 80), the radio performs an energy-detect check for a Point Coordination Function Interframe Space (PIFS) duration (25 µs) immediately prior to the transmission opportunity (TXOP).
• If any secondary subchannel is sensed busy during the PIFS window, legacy 802.11n/ac standards forced the AP to demote its transmission to the next narrowest uncontested bandwidth (e.g., dropping from 80 MHz down to 20 MHz).

Preamble Puncturing (802.11ax / 802.11be)

In dense enterprise deployments, wide channels frequently encounter localized interference (e.g., an adjacent AP on a secondary channel or a narrowband radar pulse). In legacy networks, a busy 20 MHz slice invalidated the entire 80 or 160 MHz channel.

Preamble Puncturing allows an 802.11ax/be AP to "puncture" (notch out) a busy 20 MHz subchannel while transmitting across the remaining non-contiguous bandwidth:

80 MHz Channel Allocation:
┌──────────────┬──────────────┬──────────────┬──────────────┐
│ Primary 20   │ Secondary 20 │ Secondary 40 │ Secondary 40 │
│  (Clear)     │ (Interfered) │  (Clear)     │  (Clear)     │
└──────────────┴──────────────┴──────────────┴──────────────┘
       │              │              │              │
       ▼              ▼              ▼              ▼
  Transmitted     PUNCTURED     Transmitted    Transmitted
  (Active Data)   (No Signal)   (Active Data)  (Active Data)
  ◄──────────────── 60 MHz Usable Bandwidth ────────────────►

In Wi-Fi 7, preamble puncturing combines with Multi-Resource Unit (MRU) support, allowing clients to receive large non-contiguous tone blocks across punctured 80, 160, and 320 MHz channels, preventing throughput collapse in congested enterprise RF environments.

---

Multi-Link Operation (MLO) in Wi-Fi 7 (802.11be)

In legacy Wi-Fi (802.11a through 802.11ax), a client station establishes an association on a single frequency band (e.g., connecting to an AP exclusively on 5 GHz). Although enterprise APs feature concurrent 2.4 GHz, 5 GHz, and 6 GHz radios, a client could only use one radio at a time. Switching bands required a disruptive roaming event.

Wi-Fi 7 breaks this limitation by introducing Multi-Link Operation (MLO):

Multi-Link Device (MLD) Architecture

An MLO-capable access point is structured as an AP-MLD (Access Point Multi-Link Device), and an MLO client is structured as a non-AP MLD. The device separates MAC processing into two layers:

• Unified Upper MAC (UMAC): Manages a single IP address, single 802.1X security context, unified sequence numbering, and packet reassembly.
• Independent Lower MACs (LMAC) & PHYs: Operates discrete physical radio transceivers across 2.4 GHz, 5 GHz, and 6 GHz links simultaneously.

Three Core MLO Operational Modes

1. Simultaneous Transmit and Receive (STR):
   • The client hardware possesses independent radio chains, separate basebands, and high-isolation RF filtering.
   • The client can transmit data on Link 1 (e.g., 5 GHz) while simultaneously receiving data on Link 2 (e.g., 6 GHz) without internal RF desensitization.
   • Delivers ultra-low, deterministic latency (sub-5ms) and aggregated throughput.
2. Non-Simultaneous Transmit and Receive (NSTR):
   • Found in lower-cost or power-constrained mobile devices where antenna proximity causes internal cross-talk between frequency bands.
   • The client can communicate across multiple links, but transmissions must be synchronized in direction: transmitting on Link 1 blinds the receiver on Link 2. Link transmissions must align in time.
3. Enhanced Multi-Link Single Radio (EMLSR):
   • The client has a single multi-band radio transceiver paired with multiple antennas. The client listens passively across multiple links (e.g., 5 GHz and 6 GHz). When the AP begins transmitting on whichever link is clear first, the client dynamically switches all its antenna chains to that active link to receive high-speed MIMO data.

---

802.11 Medium Access: CSMA/CA, Interframe Spaces & The NAV

Because radio frequency signals cannot transmit and receive on the same channel simultaneously without overwhelming the receiver (half-duplex medium), 802.11 networks cannot use Ethernet's Collision Detection (CSMA/CD). Instead, 802.11 mandates Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA).

Medium Busy           DIFS/AIFS      Random Backoff Window
═══════════════════►│◄─────────►│◄─────────────────────────────►│
                    │           │ Slot │ Slot │ Slot │ Slot │   │ Frame Transmission
                    │           │  1   │  2   │  3   │  4   │   ▼
                    │           └──────┴──────┴──────┴──────┴──────────────────────

Carrier Sense Mechanisms: Physical vs. Virtual

1. Physical Carrier Sense (Clear Channel Assessment - CCA):
   • Preamble Detect (Carrier Sense): The radio decodes 802.11 frame preambles down to -82 dBm. If a valid preamble is detected, the channel is flagged as busy for the duration indicated in the PLCP header.
   • Energy Detect (ED): Senses raw non-Wi-Fi RF energy (e.g., microwave ovens, analog cameras, radar) at a threshold typically 20 dB higher (-62 dBm).
2. Virtual Carrier Sense (Network Allocation Vector - NAV):
   • Contained within the Duration/ID field of the 802.11 MAC header. When any station transmits a frame, it encodes the number of microseconds required to complete the remaining exchange (e.g., SIFS + ACK).
   • All listening stations extract this value and set their internal NAV counter. Stations defer transmission until the NAV reaches zero, avoiding collisions without continuously polling the physical radio.

Interframe Spaces (IFS) Hierarchy

Timing gaps separate successive frames to establish priority on the medium:

• SIFS (Short Interframe Space): The shortest waiting period (16 µs on 5/6 GHz, 10 µs on 2.4 GHz). Reserved for high-priority immediate responses: ACKs, CTS frames, and BlockAcks.
• PIFS (PCF Interframe Space): SIFS + 1 Slot time (25 µs). Used by APs to seize the medium for beacon transmission, channel switch announcements, and secondary channel CCA.
• DIFS (DCF Interframe Space): SIFS + 2 Slot times (34 µs on 5/6 GHz). Standard waiting interval for legacy best-effort contention.
• EIFS (Extended Interframe Space): Invoked when a station receives a corrupted frame (bad FCS). Enforces a long quiet period to prevent colliding with an ACK transmitted by another station.
• AIFS (Arbitration Interframe Space): Replaces DIFS under 802.11e QoS (WMM), assigning shorter delays to voice/video traffic and longer delays to background traffic.

Contention Window (CW) & Binary Exponential Backoff

If the medium remains clear after the IFS, the station initiates a randomized backoff countdown:

$\text{Backoff Time} = \text{Random}(0, \text{CW}) \times \text{Slot Time}$

• The station selects an integer randomly between 0 and $CW_{\text{min}}$ (e.g., 15 slots).
• For each idle slot time (9 µs on 5/6 GHz), the countdown decrements by 1.
• If another station transmits, the countdown freezes until the channel is clear again.
• If a transmitted frame fails to receive an ACK, a collision is assumed. The station doubles its Contention Window ($CW_{\text{new}} = (CW_{\text{old}} \times 2) + 1$) up to $CW_{\text{max}}$ (e.g., 1023 slots), exponentially expanding backoff delay to reduce future collisions.

---

802.11 Network Topologies: BSS, ESS, IBSS & MBSS

IEEE 802.11 defines four discrete architectural topologies:

• BSS (Basic Service Set): The fundamental building block of an infrastructure WLAN. Consists of a central Access Point and its associated client stations. Identified by a BSSID (Basic Service Set Identifier), which is the 48-bit MAC address of the AP's radio interface.
• ESS (Extended Service Set): Two or more BSSs interconnected by a common Distribution System (DS)—typically enterprise Ethernet switches. BSSs within an ESS broadcast a shared SSID (Service Set Identifier), allowing mobile clients to roam seamlessly across APs while maintaining Layer 3 IP sessions.
• IBSS (Independent Basic Service Set): An ad-hoc, peer-to-peer wireless topology containing no access point. Client stations communicate directly with one another. Stations generate a randomized BSSID and take turns transmitting distributed Beacons.
• MBSS (Mesh Basic Service Set / 802.11s): A wireless mesh infrastructure consisting of Mesh Points (MPs), Mesh Access Points (MAPs), and Mesh Portal Points (MPPs). Nodes dynamically establish wireless backhaul links using the Hybrid Wireless Mesh Protocol (HWMP), routing traffic without wired Ethernet drops.

---

802.11 MAC Frame Architecture & The Four-Address Field Matrix

Unlike Ethernet (802.3) frames which contain only two MAC addresses (Source and Destination), the 802.11 MAC header spans up to 36 bytes and incorporates four distinct address fields.

Anatomy of the 802.11 MAC Header

┌─────────────────┬─────────────┬─────────────┬─────────────┬─────────────┬─────────────┬─────────────┬─────────────┬───────────┐
│  Frame Control  │ Duration/ID │  Address 1  │  Address 2  │  Address 3  │ Seq Control │  Address 4  │ QoS Control │ Frame Body│
│    (2 Bytes)    │  (2 Bytes)  │  (6 Bytes)  │  (6 Bytes)  │  (6 Bytes)  │  (2 Bytes)  │  (6 Bytes)  │  (2 Bytes)  │(0-2304 B) │
└─────────────────┴─────────────┴─────────────┴─────────────┴─────────────┴─────────────┴─────────────┴─────────────┴───────────┘

The Frame Control Field (16 Bits)

• Protocol Version (2 bits): Always set to 00.
• Type (2 bits): Identifies the frame category: 00 = Management, 01 = Control, 10 = Data, 11 = Reserved.
• Subtype (4 bits): Identifies the specific functional frame format within the type.
• To DS (1 bit): Set to 1 if the frame is destined for the Distribution System (uplink to AP).
• From DS (1 bit): Set to 1 if the frame originates from the Distribution System (downlink from AP).
• More Fragments (1 bit): Set to 1 if additional fragmented MSDU pieces follow.
• Retry (1 bit): Set to 1 if this frame is a retransmission due to an unacknowledged prior attempt.
• Power Management (1 bit): Set to 1 to signal the AP that the client is entering Power Save (sleep) mode.
• More Data (1 bit): Set to 1 by an AP to inform a sleeping client that additional frames are buffered.
• Protected Frame (1 bit): Set to 1 if the frame payload is cryptographically encrypted (CCMP, GCMP).
• Order (1 bit): Set to 1 if strictly ordered frame processing is enforced.

The Duration/ID Field (Virtual Carrier Sense)

In non-PS-Poll frames, the Duration/ID field carries a time value in microseconds. Client stations overhearing the transmission extract this value and update their internal Network Allocation Vector (NAV) timer. The NAV acts as a virtual carrier-sense mechanism: client stations defer transmission until the NAV counts down to zero, reserving the airwaves for subsequent CTS, Data, and ACK exchanges.

The Four-Address Field Interpretation Matrix

The meanings of Address 1, 2, 3, and 4 shift dynamically based on the To DS and From DS bits:

• RA (Receiver Address): The immediate radio receiver over the RF air interface.
• TA (Transmitter Address): The immediate radio transmitter over the RF air interface.
• DA (Destination Address): The ultimate end-point Layer 2 destination on the network.
• SA (Source Address): The original Layer 2 generating device on the network.

---

Frame Categorization: Management, Control & Data

802.11 frames are divided into three distinct functional categories:

1. Management Frames (Type 00)

Responsible for establishing, maintaining, and tearing down wireless associations. Management frames contain an unencrypted MAC header, but their bodies may be protected by 802.11w Protected Management Frames (PMF):

• Beacon (Subtype 1000): Broadcast periodically by APs (typically every 100 TU / 102.4 ms) to announce SSID, supported rates, security cipher suites, RRM parameters, and traffic indication maps (TIM).
• Probe Request (0100) & Probe Response (0101): Active discovery mechanism used by clients to search for specific SSIDs or any reachable AP.
• Authentication (1011) & Deauthentication (1100): Open system authentication or SAE Dragonfly handshakes; deauthentication terminates an active association.
• Association Request (0000) & Association Response (0001): Establishes client membership in a BSS, exchanging listen intervals, capabilities, and supported MCS rates.
• Action Frames (1101): Extensible frame format powering advanced protocols, including 802.11k Neighbor Reports, 802.11v BSS Transition Management, BlockAck setup (ADDBA), 802.11h Channel Switch Announcements, and beamforming sounding (NDPA).

2. Control Frames (Type 01)

Assist with medium reservation, channel contention, and packet acknowledgments. Control frames have no payload body and contain only 1 or 2 address fields:

• RTS (Subtype 1011) & CTS (Subtype 1100): Request to Send / Clear to Send handshake reserving the medium via NAV Duration fields to eliminate hidden-node collisions.
• ACK (Subtype 1101): Unicast acknowledgment frame transmitted after SIFS, confirming error-free reception of a data frame.
• BlockAckReq (1000) & BlockAck (1001): Enables acknowledging an entire burst of aggregated frames (A-MPDUs) using a single bitmap acknowledgment frame.
• PS-Poll (1010): Transmitted by power-saving clients to request that the AP release a single buffered frame.
• Trigger Frame (0010): Transmitted by 802.11ax/be APs to initiate and synchronize Uplink MU-OFDMA and MU-MIMO transmissions.

3. Data Frames (Type 10)

Transport upper-layer network packets (such as IPv4, IPv6, ARP, and DHCP) across the wireless medium:

• Data (Subtype 0000): Standard unclassified data payload.
• QoS Data (Subtype 1000): Standard enterprise data frame containing a 2-byte QoS Control field. The QoS Control field contains a 3-bit User Priority (UP) value (ranging from 0 to 7) mapped from 802.1p/DSCP into four WMM Access Categories (AC_VO [Voice], AC_VI [Video], AC_BE [Best Effort], AC_BK [Background]).
• Null Function (Subtype 0100): A data frame with zero payload body. Transmitted by client devices to inform the AP of changes in power-management state (toggling the Power Management bit between 0 and 1) or to maintain association keepalives.