CWAP – 802.11 Data Frame Types

There are 15 different types of Data Frames defined in IEEE 802.11-2007 standard. Data frames with a value of 1 in the QoS subfield of the Subtype field (Bit7) are collectively referred to as QoS data frames. Each of these data subtypes contains QoS in their names, and this frame format is distinguished by the presence of a QoS Control field in the MAC header.

A QoS STA always uses QoS data frames for data transmissions to other QoS STAs. A QoS STA uses frames with the QoS subfield of the Subtype field set to 0 for data transmissions to non-QoS STAs. A non-QoS STA always uses frames with the QoS subfield of the Subtype field set to 0 (Bit7) for data transmissions to other STAs.

All STAs use frames with the QoS subfield of the Subtype field set to 0 (Bit7) for broadcast data frames unless a transmitting STA knows that all STAs in a BSS have QoS capability, in which case the transmitting STAs use QoS data frames.

Below table summarize all Data Frame types. Each bit of the Subtype field indicate different type of Data frames (eg Bit7=1 QoS , Bit6=1 Null frame, Bit5=1 CF-Poll & Bit4=1 CF-ACK)

In wireshark you can filter all Data frame using below filter (Type =2)

wlan.fc.type == 2

Data:
In Non-QoS Data frames there is no QoS control field present in the MAC header. Below shows a simple data frame which you can filter using below ( Type 2 , subtype 0). In this frame To DS & From DS field set to 1 & therefore used 4 addresses field in MAC header (Typically all other scenarios, 3 addresses field use in MAC header)

wlan.fc.type_subtype == 0x0020

Data + CF-ACK :

wlan.fc.type_subtype == 0x0021

Data + CF-Poll :

wlan.fc.type_subtype == 0x0022

Data + CF-Ack + CF-Poll :

wlan.fc.type_subtype == 0x0023

Null Data :
Here is a Null (no data frame). In this case this frame is used to indicate client is going to Power Save mode sending this to AP by the client ( Note that Power Mgmt bit set to 1 in Frame Control)