802.11 PROTOCOL INTELLIGENCE

IE Catalog - Information Elements

Information Elements (IEs) are the extensible payload of 802.11 management frames. Each IE follows a TLV (Type-Length-Value) structure: one byte Element ID, one byte Length, then the value. Beacon frames carry most IEs; Association frames carry capability-related IEs. This catalog covers the most important IEs from 802.11-1997 through 802.11be (Wi-Fi 7).

IEEE 802.11-2020 §9.4 CWAP Core Domain

The Beacon frame is the most information-dense management frame in 802.11 - capability advertisement, security policy, channel parameters, and load status broadcast every 102.4ms. Most engineers read the SSID and move on. The RSN IE and QBSS Load field are where the diagnosis usually starts.

// quick wireshark filters - information elements
wlan.tag.number == 48RSN IE - cipher suites, AKM, PMF flags (bits 6-7 of Capabilities field).
wlan.tag.number == 45HT Capabilities - MCS bitmap, SGI, STBC, 40 MHz support.
wlan.tag.number == 127Extended Capabilities - BSS Transition (bit 19), TWT (bit 46), OMN (bit 34).
wlan.tag.number == 0SSID IE - zero-length in Beacon = hidden network. Zero-length in Probe Req = wildcard scan.
wlan.tag.number == 11QBSS Load - Station Count + Channel Utilisation. Key for roaming and capacity analysis.
wlan.tag.number == 255Extended IEs - HE/EHT Capabilities, Multi-Link Element (MLO). Filter by wlan_mgt.ext_tag.number for specific ID.
Full filter reference → /wireshark-filters
TLV STRUCTURE - EVERY IE FOLLOWS THIS FORMAT
Element ID 1B
Length 1B
Value / Data Length bytes

Element ID 255 = Extended Element - a second byte (Extension ID) follows the Length, then the value. Used for HE/EHT IEs to avoid exhausting the 255-value Element ID space.

CorePHYSecurityRegulatoryQoSHotspotWi-Fi7
ID
Name
Length
Std
Detail & PCAP filter
0
SSID
Core
0–32 B
802.11
Network name (Service Set Identifier)
UTF-8 string, max 32 octets. Zero-length SSID in Beacon = hidden network. Zero-length SSID in Probe Request = wildcard (find all APs). Present in: Beacon, Probe Req/Resp, Association Req/Resp, Reassociation Req/Resp.
wlan.tag.number == 0
1
Supported Rates
Core
1–8 B
802.11
Mandatory + optional data rates for this BSS
Each byte: bit7=basic/mandatory, bits6-0 = rate × 500 kbps. Example: 0x8C = 6 Mbps mandatory (basic), 0x12 = 9 Mbps optional. Up to 8 rates. Additional rates → IE 50 (Extended Supported Rates).
wlan.tag.number == 1
3
DS Parameter Set
Core
1 B
802.11
Current channel number (2.4 GHz)
Single byte with the current primary channel (1–14). Not required in 5/6 GHz bands - HT/VHT/HE Operation IEs carry the channel info there. Useful for off-channel beacon capture identification.
wlan.tag.number == 3
5
TIM
Core
variable
802.11
Buffered-frame bitmap for power-saving STAs
DTIM Count (1B) + DTIM Period (1B) + Bitmap Control (1B, bit0=multicast pending) + Partial Virtual Bitmap (1-251B). One bit per AID (1-2007). Bit set → AP has buffered unicast frames for that STA. STA wakes on DTIM beacon to retrieve buffered frames.
wlan.tag.number == 5
7
Country
Regulatory
variable
802.11d
Regulatory domain: country + channel/power triplets
3-char ISO 3166 country code (e.g., "US ", "DE ", "JP ") + triplet sets of (First Channel, Number of Channels, Max TX Power dBm). Required for 5 GHz operation in most jurisdictions. STAs auto-configure TX power and allowed channels.
wlan.tag.number == 7
11
QBSS Load
QoS
5 B
802.11e
AP load: STA count + channel utilisation
Station Count (2B, 0-N), Channel Utilisation (1B, 0=0% to 255=100%), Available Admission Capacity (2B, in 32µs units). Used by 802.11v BSS Transition and 802.11k Neighbor Reports for load-based roaming decisions. CWAP exam: 255=100% utilisation.
wlan.tag.number == 11
33
Power Capability
Regulatory
2 B
802.11h
Min and max TX power of the STA
Minimum Capability (1B, signed dBm) + Maximum Capability (1B, signed dBm). Exchanged in Assoc Req/Resp when operating in 5 GHz DFS channels. Required for TPC compliance with 802.11h.
wlan.tag.number == 33
36
Supported Channels
Regulatory
variable
802.11h
STA's supported channel list (5 GHz DFS)
Pairs of (First Channel Number, Number of Channels). Informs AP of STA's regulatory channel set. Required in Assoc Req when operating on 5 GHz DFS channels. Enables TPC/DFS compliance verification.
wlan.tag.number == 36
45
HT Capabilities
PHY
26 B
802.11n
MIMO, SGI, STBC, LDPC, 40 MHz, MCS 0-76
HT Cap Info (2B): LDPC Coding, 40 MHz support, SM Power Save, Green Field, SGI-20, SGI-40, TX STBC, RX STBC, HT Delayed BA, Max AMSDU Length, DSSS/CCK-40, 40 MHz Intolerant. A-MPDU Params (1B): max length exponent, density. Supported MCS Set (16B): one bit per MCS 0-76. Extended HT Cap (2B), TxBF Cap (4B), ASEL Cap (1B).
wlan.tag.number == 45
48
RSN
Security
variable
802.11i
WPA2/WPA3 cipher suites, AKMs, PMF flags
Version (2B)=1. Group Cipher Suite (4B): OUI 00-0F-AC + suite type (4=CCMP-128, 8=GCMP-128, 9=GCMP-256). Pairwise Cipher Suite Count + List. AKM Suite Count + List: type 2=PSK, 5=802.1X, 8=SAE, 18=OWE. RSN Capabilities (2B): MFPC=bit6, MFPR=bit7, OCVC=bit13, PBAC=bit14. PMKID Count + List (0-N PMKIDs for fast reconnect).
wlan.tag.number == 48
50
Extended Supported Rates
Core
variable
802.11g
Additional rates beyond IE 1's 8-entry limit
Same format as IE 1. Used when more than 8 rates are advertised (e.g., 802.11g needs: 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54 Mbps = 12 rates). Typical 802.11ac AP: IE 1 has 6/9/12/18 Mbps basic, IE 50 has 24/36/48/54 Mbps.
wlan.tag.number == 50
54
IBSS Parameter Set
Core
2 B
802.11
ATIM Window for ad-hoc (IBSS) networks
ATIM Window (2B, in TUs). Present only in IBSS beacons. ATIM = Announcement Traffic Indication Message - interval during which power-save nodes wake to receive ATIM frames indicating buffered traffic.
wlan.tag.number == 54
61
HT Operation
PHY
22 B
802.11n
Primary channel, secondary channel, HT protection mode
Primary Channel (1B). HT Operation Info (5B): Secondary Channel Offset (above=1/below=3/none=0), STA Channel Width, RIFS Mode, HT Protection (0=no protection, 1=nonmember, 2=20MHz, 3=non-HT mixed), NonGF Present, OBSS Non-HT STAs Present. Basic HT-MCS Set (16B).
wlan.tag.number == 61
74
Overlapping BSS Scan
PHY
14 B
802.11n
40 MHz coexistence parameters in 2.4 GHz
Scan Passive Dwell (2B), Scan Active Dwell (2B), Scan Interval (2B), Passive Total per Channel (2B), Active Total per Channel (2B), Width Trigger Scan Interval (2B), Activity Threshold (2B). Governs when a 40 MHz BSS must fall back to 20 MHz to avoid interfering with legacy 20 MHz BSSs.
wlan.tag.number == 74
107
Interworking
Hotspot
3–9 B
802.11u
Hotspot 2.0 / Passpoint - ANQP network type
Access Network Type (4b): 0=private, 2=free public, 3=chargeable public, 4=carrier, 5=emergency. Internet bit. ASRA, ESR, UESA bits. Venue Info (optional 2B). HESSID (optional 6B, homogeneous ESSID for Passpoint federation). Presence triggers GAS/ANQP queries for network selection.
wlan.tag.number == 107
127
Extended Capabilities
Core
variable
802.11
Bitmask of optional 802.11 features
Variable-length bitmask. Key bits: 2=Extended Channel Switching, 10=Proxy ARP (802.11v), 19=BSS Transition (BTM/802.11v), 25=TDLS Peer UAPSD, 34=Operating Mode Notification, 43=FILS, 46=TWT Requester, 47=TWT Responder, 61=TWT Info Frame Exchange, 62=FILS Discovery, 70=Multi-BSS (Collocated).
wlan.tag.number == 127
191
VHT Capabilities
PHY
12 B
802.11ac
256-QAM, MU-MIMO, 80/160 MHz, STBC, beamforming
VHT Cap Info (4B): Max MPDU Length (3948/7991/11454), Supported Channel Width (80/160/80+80), LDPC, SGI-80, SGI-160, TX/RX STBC, SU Beamformer/Beamformee, MU Beamformer, Max AMPDU Length, Link Adaptation. VHT Supported MCS and NSS Set (8B): Rx/Tx MCS map for NSS 1-8, max data rate.
wlan.tag.number == 191
192
VHT Operation
PHY
5 B
802.11ac
BSS channel width, center frequency segments
Channel Width (1B): 0=20/40 MHz, 1=80 MHz, 2=160 MHz, 3=80+80 MHz. CCFS0 (1B): Channel Center Frequency Segment 0. CCFS1 (1B): Segment 1 for 80+80 or 160 MHz. Basic VHT-MCS and NSS Set (2B): minimum MCS supported by all STAs in BSS.
wlan.tag.number == 192
221
Vendor Specific
Core
variable
802.11
OUI-namespaced proprietary IEs (WPA, WMM, P2P, etc.)
OUI (3B) + Type (1B) + Data. Key instances: Microsoft OUI 00:50:F2 type 1 = WPA IE (legacy WPA1). Microsoft OUI type 2 = WMM/WPA IE. Microsoft OUI type 4 = WPS (Wi-Fi Simple Configuration). Wi-Fi Alliance OUI 50:6F:9A: P2P (type 9), WFD (type 10), HS2.0 (type 16). Cisco OUI 00:40:96: Aironet IE.
wlan.tag.number == 221
255+35
HE Capabilities
PHY
variable
802.11ax
Wi-Fi 6/6E: OFDMA, TWT, 1024-QAM, BSS Color
IE 255 (Extended) with Extension ID 35. HE MAC Cap (6B): +HTC HE Support, TWT Req/Resp, Dynamic SMPS, Fragmentation Level, Multi-TID BA, A-MSDU Fragmentation, OM Control. HE PHY Cap (11B): Channel Width Set, Preamble Puncturing Rx, Doppler, STBC, LDPC, DCM, NDP-4x-HE-LTF, STBC Tx on 80/160, MU Beamformer. MCS and NSS Set: maps per BW (80/160/80+80 MHz) for NSS 1-8.
wlan.tag.number == 255 && wlan.he.mac_cap_info
255+36
HE Operation
PHY
variable
802.11ax
HE BSS Color, OFDMA operation parameters
IE 255 (Extended) with Extension ID 36. HE Operation Params (3B): Default PE Duration, TWT Required, TXOP Duration RTS Threshold, VHT Op Info Present. BSS Color Info (1B): BSS Color (6b, 0=disabled), Partial BSS Color, BSS Color Disabled. Basic HE-MCS and NSS Set (4B). Optional: VHT Op Info, MaxCo-Hosted BSSID.
wlan.tag.number == 255 && wlan.he_operation
255+107
Multi-Link Element
Wi-Fi7
variable
802.11be
MLO: advertises all links of an AP MLD
IE 255 (Extended) with Extension ID 107. Multi-Link Control (2B): ML type=0 (Basic ML), Link ID, BSS Parameters Change Count. Common Info: MLD MAC Address (6B), Link ID (1B), BSS Parameters. Per-Link Info: each link's BSSID, operating channel, beacon interval, DTIM info. Enables TID-to-Link mapping negotiation.
wlan.tag.number == 255 && wlan_mgt.ext_tag.number == 107
255+108
EHT Capabilities
Wi-Fi7
variable
802.11be
Wi-Fi 7: 4096-QAM, 320 MHz, 16 SS, preamble puncturing
IE 255 Extension ID 108. EHT MAC Cap (2B): NSEP Priority Access, EHT OM Control, Triggered TXOP Mode 1/2, Restricted TWT. EHT PHY Cap (9B): 320 MHz in 6 GHz, 242-tone RU, NDP 4x EHT-LTF, Partial BW UL MU-MIMO, SU Beamformer/Beamformee, MU Beamformer, 320 MHz BF. Supported EHT-MCS and NSS Set: MCS 0-13 per BW.
wlan.tag.number == 255 && wlan_mgt.ext_tag.number == 108

Where IEs Appear - Frame Type Reference

IEBeaconProbe ReqProbe RespAssoc ReqAssoc RespAuthReassoc Req
SSID (0) ✓✓✓✓——✓
Supported Rates (1) ✓✓✓✓✓—✓
DS Param (3) ✓—✓————
TIM (5) ✓——————
Country (7) ✓—✓————
QBSS Load (11) ✓—✓————
RSN (48) ✓—✓✓✓—✓
HT Cap (45) ✓✓✓✓✓—✓
HT Op (61) ✓—✓————
VHT Cap (191) ✓✓✓✓✓—✓
HE Cap (255+35) ✓✓✓✓✓—✓
Ext Cap (127) ✓✓✓✓✓—✓
Multi-Link (255+107) ✓—✓✓✓—✓
// related reference
MAC Frame Format →Beacon IE Decoder →Frame Types →Security (WPA2/WPA3) →Wi-Fi 7 Track →