Frames – Data

During my blog “MAC Headers,” I already discussed the Data frames. In this small blog, I want to talk about the 4 most common data frame types. The first is the “normal” Data Frame. This is the data frame without the QoS field in the header.

You can filter in wireshark with wlan.fc.type_subtype == 0x0

NULL Data Frame
The second data frame that I want to discuss is the NULL Data Frame. The NULL frame is to tell the access point that the client is going into sleeping mode. When you check in the frames you see the power management bit set to 1.

You can filter in wireshark with wlan.fc.type_subtype == 0x4

QoS Data Frame
This frame is the same as a normal data frame, but this time there is a QoS field in the MAC header.

As you can see in this example, the QoS field is visible.
You can filter in wireshark with wlan.fc.type_subtype == 0x8

NULL QoS Data Frame
The last frame that will be discussed in this blog, is the NULL QoS data frame. This is a QoS data frame that tells the access point that the client is going to sleep. In those frames, there is a QoS field in the header and the power management bit is set to 1. You can filter in wireshark with wlan.fc.type_subtype == 0x12.