Frames – Control

Frames that are part of the control frames are RTS and CTS. Those two frames are used for avoiding collisions during transmitting. The client needs to be enabled for RTS/CTS. The RTS frame is sent by the client to request to send data. The CTS tells the client that the client is clear to send the data. You can see it as an acknowledgment from the access point. The client that transmits the RTS and has received the CTS will transmit now the data to the access point. It is possible that other clients did not hear the RTS, but it will hear the CTS, so the other clients know that there is a client that is going to transmit.

The duration field for RTS is calculated as follows: duration of the frame + CTS duration + ACK duration + 3 SIFS.\r\nThe duration field for CTS is calculated as follows: duration of the data (that the clients transmit) – CTS duration – 1 SIFS.

RTS frame:

You can filter in wireshark with wlan.fc.type_subtype == 0xb (subtype 11)

CTS frame:

You can filter in wireshark with wlan.fc.type_subtype == 0xc (subtype 12)

CTS-to-self Frames
CTS-to-self is a mechanism for protection in mixed environments. The benefit is that there is no need for sending a RTS frame. The RA field in CTS-to-self is its own address, and all clients that hear the CTS-to-self will change their duration field.

Acknowledgement Frames
The acknowledgement (ACK) frame is sent directly after all management and data frames to inform that the frame is received. If the ACK is not received by the receiver it assumes that the data was not received and will retransmit the data. The back off time is much higher from retransmitted frames, so the ack is very important.

The ACK frame is identical to a CTS frame, since it is a reply to other frames, management or data frames.

You can filter in wireshark with wlan.fc.type_subtype == 0xd (subtype 13)

PS-Poll Frames
Clients inform the access point, with the power management bit, when they go into power save mode. During this mode, the access point buffers the data for that client. The Power Save Poll Frame is to inform the access point that the client is awake and ready for receiving data. The duration field (NAV) has not the duration of the frame, but the Association ID. This is for the access point, so it knows which client is awake and which data the access point needs to transmit.

You can filter in wireshark with wlan.fc.type_subtype == 0xa (subtype 10)

Before the client transmits the PS-Poll frame, it first needs to know if there is data. The client wakes up at every Listen Interval and listens for the beacons. If the AID in the beacon is 0 (Group Traffic) or its own AID, then there is buffered data, and the client transmits the PS-Poll frame. Nowadays the process is more efficient. Instead of transmitting the PS-Poll frame, the client flips its power management bit from 1 to 0 and the access point will transmit all the buffered data. After all the data is received, the client flips the power management bit back to 1. This is not a standard process, but used by many clients.