# Module 6: Frames and Network Interaction

## Packets vs. Frames

_Just discussing the difference between Protocol Data Units (PDUs)._

## 802.11 MAC Frames

### MAC Header

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F1N7kDltUenCKWD85oWPv%2Fimage.png?alt=media&#x26;token=895a5297-49fd-47d2-b254-ce805e6e247d" alt=""><figcaption><p>802.11 MAC Header</p></figcaption></figure>

## Frame Types

### Management Frames

Management frames subtypes:

| Subtype | Field Description       |
| ------- | ----------------------- |
| 0       | Association Request     |
| 1       | Association Response    |
| 2       | Re-association Request  |
| 3       | Re-association Response |
| 4       | Probe Request           |
| 5       | Probe Response          |
| 6       | Measurement Pilot       |
| 7       | Reserved                |
| 8       | Beacon                  |
| 9       | ATIM                    |
| 10      | Disassociation          |
| 11      | Authentication          |
| 12      | Deauthentication        |
| 13      | Action                  |
| 14      | Action No ACK           |
| 15      | Reserved                |

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FJERtFb0xgcclA9MDhDA6%2Fimage.png?alt=media&#x26;token=87819524-4f1e-43dd-b06c-9336745f4abf" alt=""><figcaption><p>Beacon frame structure</p></figcaption></figure>

{% hint style="info" %}
Although SSID and ESSID are used interchangeably in Wi-Fi tools and AP configuration, there is a small difference. SSID is for single APs. ESSID is when multiple APs in an Extended Service Set (ESS) share the same SSID. The official name of the field in management frames is SSID.
{% endhint %}

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F1V1r1SRuPBZoM6z4dIWO%2Fimage.png?alt=media&#x26;token=9e134761-5986-49c9-a17a-bd6ebc160920" alt=""><figcaption><p>Management frame IE structure</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FroMkdwphxWWAkUaWRyUK%2Fimage.png?alt=media&#x26;token=5fc2f5f3-7479-481e-a402-24561ff85f34" alt=""><figcaption><p>Authentication frame structure</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F1qdteanZTxl6RsgCLLUr%2Fimage.png?alt=media&#x26;token=dfb9159a-952f-4493-b17d-7ff4695d0ff5" alt=""><figcaption><p>Association request structure</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F1uNEDeRF34sTBVIaZkkr%2Fimage.png?alt=media&#x26;token=a87d1d4b-3f92-4b20-90a4-a241e9bc402b" alt=""><figcaption><p>Association response structure</p></figcaption></figure>

### Control Frames

Control frames subtypes:

| Subtype | Field Description |
| ------- | ----------------- |
| 0-6     | Reserved          |
| 7       | Control Wrapper   |
| 8       | Block ACK Request |
| 9       | Block ACK         |
| 10      | PS-Poll           |
| 11      | RTS               |
| 12      | CTS               |
| 13      | ACK               |
| 14      | CF End            |
| 15      | CF End + CF-ACK   |

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F2yhh9MNIXDQw1lHbZDaY%2Fimage.png?alt=media&#x26;token=ec1cf5c4-d339-4995-a1aa-2af48ee7bab0" alt=""><figcaption><p>ACK Frame diagram</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FRIhE0bYIuZX1DOn9EQhU%2Fimage.png?alt=media&#x26;token=ee2f7cab-c441-4e55-b18a-c29567e2c836" alt=""><figcaption><p>RTS/CTS communication sequence</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F3SCuLoEILoUec3uAKfRt%2Fimage.png?alt=media&#x26;token=77c86296-37a8-4b25-870a-974b19b208c0" alt=""><figcaption><p>RTS frame structure</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2Fut7f4xXhBmgIxLcL3nip%2Fimage.png?alt=media&#x26;token=4cd234b7-e86a-49b2-b331-c7e607cbb262" alt=""><figcaption><p>CTS frame structure</p></figcaption></figure>

### Data Frames

Data frames subtypes:

| Subtype | Field Description              |
| ------- | ------------------------------ |
| 0       | Data                           |
| 1       | Data + CF ACK                  |
| 2       | Data + CF Poll                 |
| 3       | Data + CF ACK + CF Poll        |
| 4       | Null Function (No Data)        |
| 5       | CF ACK (No Data)               |
| 6       | CF Poll (No Data)              |
| 7       | CF ACK + CF Poll (No Data)     |
| 8       | QoS Data                       |
| 9       | QoS Data + CF ACK              |
| 10      | QoS Data + CF Poll             |
| 11      | QoS Data + CF ACK + CF Poll    |
| 12      | QoS Null (No Data)             |
| 13      | Reserved                       |
| 14      | QoS CF Poll (No Data)          |
| 15      | QoS CF ACK + CF Poll (No Data) |

## Interacting with Networks

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2Fy0szRpbxhMIpunioLC7Q%2Fimage.png?alt=media&#x26;token=d3317dd3-4527-4fb4-87d8-7bd06a760a2a" alt=""><figcaption><p>The stages in connecting to a network</p></figcaption></figure>

### Open Network

In _IEEE 802.11 Wireless Management > Fixed Parameters > Capabilities Information_, we can check the Privacy bit to see if the AP is encrypted.

### WEP

Same process as the Open Network however the _Privacy_ bit will show it is encrypted. The lack of WPA/WPA2 tags indicates WEP.

### EAPoL

_Extensible Authentication Protocol over LAN (EAPoL)_ frames are commonly used during the handshake when connecting to an AP with WPA, WPA2, WPA3, or OWE.

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FhnrIviuoo5Mjay0fEnOC%2Fimage.png?alt=media&#x26;token=68c82c34-ecc7-4da2-b0e4-5ab18c50bc56" alt=""><figcaption><p>EAPoL-Key frame structures</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FLH84QC9gtnWuNhBH8FNj%2Fimage.png?alt=media&#x26;token=66211fc8-9e51-46f5-adb3-203dfe45b727" alt=""><figcaption><p>KDE structure</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FA8U8fid8dRA8SW02WiVH%2Fimage.png?alt=media&#x26;token=5d38e413-6c1d-451e-8221-cb0a79adb23d" alt=""><figcaption><p>RSNE structure</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2Fgf8rdrYu05dMHXwZjXQj%2Fimage.png?alt=media&#x26;token=2e81e5d6-aa78-4ca2-9619-06ad779de643" alt=""><figcaption><p>RSNE Pairwise Cipher Suite item</p></figcaption></figure>

#### WPA1

Advertises WPA1 PSK TKIP.

#### WPA2

Advertises WPA1 and WPA2, both with AES/CCMP and TKIP.

#### WPA3

Advertises with SAE in the RSN IE, and 802.11w which is mandatory for WPA3.

#### OWE

Advertises an RSN IE with OWE, and 802.11w which is also mandatory for OWE.

#### WPS

Advertises with a WPS beacon tag.

