WLAN MAC Protocol Inside
This article describes WLAN MAC layer protocols as per IEEE 802.11 MAC layer specifications.
The format of the MAC frames is specified here. All stations should be able to properly construct frames for transmission and decode frames upon reception, as specified here.
802.11 MAC frame is composed of header, body and FCS part.
• MAC header: It consists of frame control field, duration, address fields 1-3, sequence control field.
• Frame body: This field vary in size and consists of information based on frame type to be carried.
• FCS: stands for Frame Check Sequence, this is 32 bit CRC (i.e. cyclic redundancy code).
The MAC frame format comprises a set of fields that occur in a fixed order in all frames. The figure below depicts the generic MAC frame format as defined in IEEE 802.11 MAC specifications.
The fields Address field 2 and 3, sequence control field, address-4, frame body are present in particular frame types only. They do not exist in all the frames. Each of these fields are defined below.
MAC Frame Fields
Frame Control Field
This Frame control field composed of following sub-fields :
• Protocol Version
• To DS
• From DS
• More Fragments
• Power Management
• More Data
• Wired Equivalent Privacy (WEP)
• Other fields
All the above sub-fields of Frame Control field is depicted in the following figure.
This field is of size 16 bits. It carries following fields.
• In control type frames of subtype Power Save (PS)-Poll, the Duration/ID field carries the association identity (AID) of the station that transmitted the frame in the 14 least significant bits (LSB), with the 2 most significant bits (MSB) both set to 1. AID value varies between values from 1 to 2007.
• In all the other frames, this field contains duration value as specified for each of the frame. For all the frames transmitted during the CFP (contention free time period) this field is set to 32,768. If the content of this field is less than 32768, it is used to update NAV (Network Allocation Vector).
There are four address fields in the 802.11 WLAN MAC frame.
These fields describe following sub-fields:
• Source address (SA)
• Destination address (DA)
• Transmitting station address (TA)
• Receiving station address (RA)
Not all the frames contain these fields; some may or may not be present. Above address field contents are depicted in the figure below.
A station uses contents of the address-1 field to perform receive address matching. In the cases where in address-1 field contains group address then BSS-ID is validated. This ensures that broadcast/multicast is originated from the same BSS. A STA uses the contents of the address-2 field to route acknowledgment if an ACK is required. The DA is the destination of the MSDU (or fragment thereof) in the frame body field. The SA is the address of the MAC entity that initiated the MSDU (or fragment thereof) in the frame body field. The RA is address of the station contained in access point in WDS that is the next immediate intended recipient of the frame. The TA is the address of the station contained in the access point in the WDS that is transmitting the frame.
The data frame BSS-ID is determined as mentioned below:
• If station is an Access Point or if it is associated with Access Point, BSSID is the address currently in use by station contained in the Access Point.
• If STA is member of an IBSS, then the BSSID is BSSID of IBSS system.
Sequence Control field
Sequence control field is of length 16 bits and consists of two sub-fields viz. sequence number and fragment number.
The sequence number field is 12 bit in length. It indicates sequence number of MSDU/MMPDU. Each MSDU/MMPDU transmitted by station is assigned a sequence number. The sequence numbers are assigned from a modulo 4096 counter. It starts at value of 0 and incremented by 1 for each MSDU/M-MPDU transmission. Each fragment of MSDU/M-MPDU contains assigned sequence number. The sequence number remains constant in all re-transmissions of an MSDU,M-MPDU or fragment. The fragment number field is 4 bit in length.It indicates the number of each fragment of an MSDU or MMPDU. The fragment number is set to zero in the first or only fragment of an MSDU or MMPDU and is incremented by one for each successive fragment of that MSDU or MMPDU. The fragment number remains constant in all retransmissions of the fragment.
Frame Body field
The Frame Body is a variable length field that contains information specific to individual frame types and subtypes. The minimum frame body is 0 octets. The maximum length frame body is defined by the maximum length (MSDU + ICV + IV), where ICV and IV are the WEP fields.
The WLAN FCS field is a 32-bit field containing a 32-bit CRC. The FCS is calculated over all the fields of the MAC header and the Frame Body field. These are referred to as the calculation fields.
The FCS is calculated using the following standard generator polynomial of degree 32: G(x) = x32 + x26 + x23 + x22 + x16 + x12 + x11 + x10 + x8 + x7 + x5 + x4 + x2 + x + 1
The FCS is the 1's complement of the sum (modulo 2) of the following:
• The remainder of xk * (x31+x30+x29+...+x2 + x + 1) divided (modulo 2) by G(x), where k is the number of bits in the calculation fields.
• The remainder after multiplication of the contents (treated as a polynomial) of the calculation fields by x32 and then division by G(x).
As frames are about to be sent then the FCS is calculated and appended. When a station receives a frame it can calculate teh FCS of the frame and compare it to the one received. If they match, it is assumed that the frame was not distorted during the transmission.
WLAN MAC frames Links
WLAN Association Request and response frame
WLAN authentication Request and deauthentication frame
WLAN beacon frame
WLAN passive vs active scanning frame
WLAN Probe Request and response frame
WLAN reassociation Request and response frame
WLAN RTS and CTS frame