Recent in Technology

WiFi Hacking From Basics - Lesson 3

Wireless Packets

In the picture you can see the 802.11 Mac Frame. If you don't understand the picture, don't worry. When I first watched it, I didn't know anything for sure. You will know each step. So let's continue to discuss the little things you should know.


  • Protocol Version: Protocol Version describes the 802.11 protocol version used.
  • Type & Subtype: Type & Subtype describes the function of Control, Data and Management frames. There are three Frame Type Fields: Control (Value 1), Data (Value 2) and Management (Value 3), and each Frame Type Field has sub-types to describe the specific functions associated with them.
  • Retry: Retry indicates that a frame has been transmitted.
  • To DS & From DS: It shows the input and output of frames.
  • Power Mgmt: Power management. He is STA Value 0 and Active mode Are you there? Or Value 1 and indicate whether it is in Power-save Mode.
  • WEP: Whether encryption and authentication are used in the WEP frame It indicates.

It is necessary to remember some of the above information. It doesn't mean you have to memorize it. If you read it to remember, you will get it.

Depending on the frame type, Duration (ID) can be set as Power Save Poll with Station Association Identity (AID) [Type 1: Subtype 10]. It can also be set as the Duration Value [Order] used to calculate the Network Allocation Vector (NAV). Order indicates that frames can be sent using the Strictly Ordered Service, and by default the Order field is not set.

About addresses

Based on To DS and From DS, let me describe the situations where addresses can exist in the table below.

If you look at the chart above, the first row shows an example of IBSS Mode. When the two STAs connect to each other, you will see that neither From DS nor To DS has been set to zero.

In the second row, From DS is set to 1, and this is when the AP tells the STA.

In the third row, you will see a 1 only in the ToDS bit. From DS is zero. This is when the STA tells the AP back.

At the bottom, you will see that both the From and To bits become 1. AP is the stage where you can start talking about other things.

Sequence Control includes two sub-fields to determine whether frames can be duplicated. Sequence Number [12 bit] indicates the sequence number of each frame, and the numerical value for this field can be from 0 to 4049. After reaching 4049, the next sequence value returns to zero. Let's say 0- 4049 is running. Next is the fragment number. Fragment Number [4bit] also indicates the number of fragments of the sent frame. For him, the numerical difference is only from 0 to 15.


The data field can contain more than 2324 bytes of data. The maximum 802.11 MAC Service Data Unit (MSDU) is 2304. But different encryption methods add more data depending on their technique. To be clear, WEP adds 8 bytes. I added 8 more to the original 2304, which is 2312 bytes. In WPA1, which is TKIP, 20 is added. So 2304+20=2324bytes. WPA2 (CCMP) is 16. 2304 + 16 = 2320 bytes.

Wireless Control frame

Wireless Control Frame is actually when the connection will be transmitted, Just message snippets that tell devices when to stop and when a connection fails.

If you look at the chart above, you can see what we mean. The above chart is used as a reference from Offensive Security.

Thank you for reading here.

Post a Comment