8.1 Management, Control and Data Frames

Independent OpenExamPrep teaching for CWNA-109 objective 3.4 is about which 802.11 MAC frame type does which job. Harborline Terminals' warehouse WLAN fails this objective in a packet capture when a technician sees a Deauthentication and calls it a control handshake, or sees an ACK and files it under management because "it manages delivery." Those two mistakes are the classic traps: Deauthentication is management. ACK is control.

Frame format and the four address fields belong with MAC addressing. This section assumes you can find Frame Control, Duration/ID, and the address list. What you must add is the Type / Subtype split and a working inventory of the frames the exam actually names.

Why the MAC splits frames into three types

Every 802.11 MAC Protocol Data Unit (MPDU) starts with a Frame Control field. Two bits named Type pick the family. Four bits named Subtype pick the specific frame inside that family. The three families CWNA-109 tests are:

A fourth Type value (11, Extension) exists in the standard for specialized PHYs. Do not let it steal the three-type story this objective tests.

Management, control, and data share a MAC header skeleton. What changes is subtype, which addresses appear, and whether a body exists. Control frames are usually short and have no Information Elements. Management frames are stuffed with tagged Information Elements: SSID, supported rates, RSN, HT/VHT/HE capabilities, TIM, country, BSS Load. Data frames carry the MAC Service Data Unit (MSDU)—or nothing, for Null.

Harborline's protocol analyzer color-codes these families. If you cannot predict the color before you click, you are not ready for items that mix a Beacon, an RTS, and a QoS Data frame in one capture.

Management frames: membership and BSS operation

Management frames do not carry user IP packets. They create and tear down the relationship between a station (STA) and an access point (AP), and they advertise how the BSS works.

Beacon

An infrastructure AP transmits Beacon frames on a schedule. A common default beacon interval is 100 time units (TU), about 102.4 ms, so Harborline's SSID "HL-YARD" is re-advertised on the order of ten times per second. A Beacon is a broadcast advertisement: timestamp for timing synchronization function (TSF) sync, beacon interval, capability information, SSID, supported and extended rates, DS Parameter Set (channel), Traffic Indication Map (TIM) for power-save, country, ERP/HT/VHT/HE operation, and often an RSN element describing AKM suites and ciphers. Independent IBSS stations also beacon. Passive scanning is "sit on a channel and wait for Beacons." If Harborline's AP is on channel 36 and a laptop dwells on 36 long enough, it learns the BSS without transmitting.

Probe Request and Probe Response

Probe Request is a station asking who is on this channel. It may use a wildcard SSID (broadcast discovery) or a specific SSID (directed discovery). Probe Response is the AP's answer, carrying much of the same BSS description as a Beacon. Active scanning is this pair. Harborline's laptop that must join quickly after sleep will probe. A radio that must stay quiet on a Dynamic Frequency Selection (DFS) channel may listen instead of probing.

Authentication

The Authentication management frame is 802.11 Authentication, a MAC state-machine step. It is not IEEE 802.1X. Open System Authentication is two frames: request, then a success response. Shared Key Authentication is the old four-frame WEP challenge exchange and is deprecated. When Open System is used with WPA2/WPA3, and how 802.1X fits after association, belongs with scanning and association. Here, remember the frame is management.

Association Request and Association Response

After 802.11 Authentication, the STA sends Association Request: capability information, listen interval, SSID, rates, RSN, and PHY capabilities (HT/VHT/HE). The AP returns Association Response with a status code and, on success, an Association ID (AID). Reassociation Request and Reassociation Response exist for moving to another AP in the ESS; roaming MAC behavior is a later objective. Harborline's scanner is not in the BSS for Class 3 data until association succeeds.

Deauthentication and Disassociation

Disassociation ends association. In the classic three-state model the STA can remain 802.11-authenticated but unassociated. Deauthentication ends authentication, which also dumps association. Both carry a reason code. Both are notifications, not a handshake the other side can refuse. Deauthentication is still a management frame. Attackers historically flooded deauthentication because many networks did not protect management frames. Protected Management Frames (PMF) is a security-chapter countermeasure; it does not recategorize Deauthentication as control.

Action

Action (and Action No Ack) frames are the extensible management bucket. Categories you should recognize by job, not by memorizing every code point: spectrum management including Channel Switch Announcement, QoS admission, radio measurement, Fast BSS Transition, SA Query used with PMF, public action, and HT/VHT/HE action. If Harborline's DFS AP must leave a radar channel, clients learn from an Action frame, not from an ACK.

Control frames: delivery helpers, not membership

Control frames do not join a BSS and do not carry an SSID Information Element. They assist the delivery of management and data frames. Duration values in many control frames drive virtual carrier sense (the network allocation vector, NAV). Channel-access timers and RTS threshold policy belong with DCF/EDCA; this section's job is to name the frames and put them in the control family.

ACK is the exam magnet. A unicast QoS Data frame that FCS-checks correctly is typically followed by an ACK control frame from the receiver. That ACK is not an Association Response, not an Action, and not a management "delivery confirmation." If Harborline's capture shows Data then a tiny frame with no body, look at Type: control, Subtype: ACK.

Block ACK is the aggregated cousin. 802.11n and later send A-MPDUs. The originator either sends an explicit BAR or uses a QoS Ack policy of Block ACK. The recipient returns a BA bitmap for that traffic identifier (TID) window instead of one ACK per MPDU. Block ACK is still control. Do not call the BA bitmap a data payload.

PS-Poll is the other control trap. A STA in power-save mode that sees its AID bit set in the Beacon TIM can send PS-Poll. The Duration/ID field is not a NAV duration in the usual sense; it carries the AID. The AP then delivers a buffered unicast frame (often with More Data set if more frames wait). Do not confuse PS-Poll with Null data. Null is Type Data. PS-Poll is Type Control.

RTS and CTS exist to set NAV around a frame exchange so hidden nodes stay quiet. CTS-to-Self is a protection trick you will meet with mixed PHYs. For this objective, lock the family: RTS and CTS are control.

Data frames: MSDUs, QoS Data, and Null

Data frames are how user traffic crosses the wireless link after association (Class 3 in infrastructure). Subtypes you must separate:

QoS Data is still the Data type. Adding a QoS Control field does not move the frame into management or control. QoS Control carries TID (user priority 0–7 for ordinary QoS data), Ack policy (Normal ACK, No ACK, Block ACK), and AP-side hints such as end of service period (EOSP) or queue size. Harborline's voice handsets should show QoS Data with a voice TID, not Action frames for every RTP packet.

Null data is the empty-payload subtype. Technicians call it "keep-alive" or "power-save frame." The useful bit is often Power Management in Frame Control: set to 1 to tell the AP "buffer my unicast; I am sleeping," set to 0 to say "I am awake." Because there is no MSDU, people mis-file Null as management. Null is Data. A station that never sends Null or PS-Poll can still go to sleep incorrectly from the AP's point of view and look like it vanished.

Legacy PCF subtypes (Data+CF-Ack, CF-Poll, and friends) still exist in the subtype table. They are not the daily enterprise capture. Do not spend exam minutes there unless the item names PCF.

Which type does what — a Harborline capture

Walk one join-and-sleep cycle on HL-YARD:

1. AP Beacon (management) advertises SSID, rates, RSN, TIM.
2. Laptop Probe Request (management); AP Probe Response (management).
3. Authentication request and success (management) — Open System for WPA2.
4. Association Request and Association Response with AID (management).
5. After the 4-way handshake (security chapter), laptop sends QoS Data (data); AP returns ACK (control).
6. If the MSDU is large and RTS threshold is on, RTS then CTS (control) wrap the data.
7. Aggregated HT/VHT/HE bursts use Block ACK (control) instead of one ACK per MPDU.
8. Laptop sends QoS Null with Power Management = 1 (data) and sleeps.
9. Beacon TIM shows the AID; laptop sends PS-Poll (control); AP delivers buffered QoS Data (data) and ACK returns (control).
10. Security logout or a rogue flood: Deauthentication (management) with a reason code. Not RTS. Not ACK.

If Harborline's DFS AP must move channel, insert an Action Channel Switch Announcement (management) before beacons hop.

Frame classes: why data waits for association

The original 802.11 frame class rules still explain capture filters:

You cannot send Harborline scanner IP traffic as 802.11 Data until the STA is associated. Control ACKs can still appear earlier because ACK is Class 1. That is another reason people mix ACK with "session management" — it shows up before association. It is still control.

Exam traps to say out loud

• Deauthentication and Disassociation are management. Reason codes do not change the Type bits.
• ACK and Block ACK are control. They confirm delivery; they do not join the BSS.
• PS-Poll is control with AID in Duration/ID. Null is data with an empty body.
• Action is management, including channel switch and SA Query.
• QoS Data is data, not a fourth type.
• Beacons and probes are management even when they feel like "control signaling" in English.

Name the Type first, then the Subtype. Harborline's tickets get shorter when the capture filter matches that sentence.