// reference · frame control decoder
802.11 Frame Control Field Decoder
Enter any 802.11 Frame Control field value from a Wireshark capture. Every bit decoded, every flag explained — with field notes on what each combination means in practice.
— Shankar K. · Source: IEEE 802.11-2020, Clause 9.2.4.1
// enter fc hex value
0x
16-bit frame control field (B15 → B0, displayed right-to-left as transmitted)
// fc field bit map — ieee 802.11-2020 clause 9.2.4.1
| Bits | Field | Size | Values | Field note |
|---|---|---|---|---|
| B0–B1 | Protocol Version | 2 bits | 00 = 802.11 (PV0), 01 = 802.11ah (PV1) | Always 00 in all WLAN frames. PV1 exists only for 802.11ah. If you see non-zero here, the frame is corrupt or from a very unusual device. |
| B2–B3 | Type | 2 bits | 00=Management, 01=Control, 10=Data, 11=Extension | These two bits tell you the frame category. 00 = management (joining/leaving). 01 = control (channel access). 10 = data (payload). Extension (11) is rarely seen. |
| B4–B7 | Subtype | 4 bits | 0000–1111 — varies by Type | Specifies the exact frame. Combined with Type, gives type_subtype (e.g., 0x08 = beacon). See table below. |
| B8 | To DS | 1 bit | 0 or 1 | Set when a data frame is destined for the distribution system (AP/WIRED side). ToDS=1 = client sending data to AP. |
| B9 | From DS | 1 bit | 0 or 1 | Set when a data frame originates from the distribution system. FromDS=1 = AP sending data to client. Both 0 = IBSS/mesh. Both 1 = WDS/inter-AP. |
| B10 | More Fragments | 1 bit | 0 = last/only, 1 = more follow | Set on all fragments except the last when a frame is fragmented. Fragmentation is rare in modern Wi-Fi but can appear with very large frames on weak links. |
| B11 | Retry | 1 bit | 0 = new, 1 = retransmission | Set on retransmitted frames. High retry rate in a PCAP = RF problems or receiver-side issues. First filter I apply: wlan.fc.retry == 1. |
| B12 | Power Management | 1 bit | 0 = active, 1 = power save | Client tells AP it will enter power save mode after this frame. AP buffers frames when this is 1. If it flips rapidly, aggressive power management is causing latency. |
| B13 | More Data | 1 bit | 0 = no buffer, 1 = buffered frames | AP tells client it has more buffered frames waiting. Client should stay awake to receive them. Used in conjunction with Power Management. |
| B14 | Protected Frame | 1 bit | 0 = cleartext, 1 = encrypted | Set when frame body is encrypted (WPA2/WPA3). Management frames with this bit set are using PMF (802.11w). Deauth without this bit = unprotected = forgeable. |
| B15 | +HTC/Order | 1 bit | 0 = no HTC, 1 = HTC field present | Indicates presence of HT Control field (802.11n and later) for link adaptation. In non-QoS frames, indicates strictly ordered delivery (legacy/deprecated). |
// tods / fromds combinations
| ToDS | FromDS | Meaning | Addr1 (RA) | Addr2 (TA) | Addr3 |
|---|---|---|---|---|---|
| 0 | 0 | IBSS or management frame | Destination STA / Broadcast | Source STA | BSSID |
| 1 | 0 | STA → AP (uplink data) | BSSID (AP) | Source STA | Destination (wired) |
| 0 | 1 | AP → STA (downlink data) | Destination STA | BSSID (AP) | Source (wired) |
| 1 | 1 | WDS / mesh inter-AP | Next AP (RA) | Previous AP (TA) | Destination STA |
// share this page
// also on this site
SK
— Shankar K., Wi-Fi engineer, Irving TX
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks
// leave a comment