802.11 maximum length of 2346 bytes, the basic structure shown below :
Frame Control
All frames are at the beginning of Frame length of the two tuples of a frame control bit Control
* Protocol Protocol version: Protocol Version value is 0, because it is the only version in the future may give other new version.
* Type Type: frame type is used to distinguish
* Subtype Subtype: This bit type represents a transmitted sub-frame, for example, a request to send RTS frame Type = 01, Subtype = 1011
* To DS and From DS: indicate a radio link frames transmitted to a wireless station and a wireless station to transmit a radio link
* More Fragments more segments: for explaining a case where the frame length is segmented, whether there are other frames. When longer packets through MAC layer segmentation process, except the last segment, the other segment is set to 1 this will.
* Retry Retry: Sometimes may need to be retransmitted frames. Any frame retransmission will set this bit to 1, in order to assist the receiving end of the frame discarding duplicates.
* Power Management Power management: indicating completion of the power management state after the current frame exchange process, the transmitting end. 1 represents a STA is Power_save mode, 0 in the active mode STA
* More Data still data: for managing a data frame, the control frame This bit must be kept zero.
* Protected Frame protected frame: 1 indicates the frame body portion comprises the encrypted processed data, 0 indicates no encryption.
* Order sequence: fragments from frame to frame may be sequentially transmitted, but the transmission side and the receiving side MAC must pay an extra expense, strictly numbered frame fragments. Once sexual strictly sequentially transmitted, this bit is set to 1.
Duration/ID
Duration Duration: according to the value of a network allocation vector NAV. Media access time limit is specified by NAV.
When the 15th bit is set to 0, Duration / ID bits will be used to set the NAV
This number represents the current transmission is expected to be how many microseconds media. Workstations must monitor any header received, and accordingly update the NAV. Any use of media time than expected values are updated NAV, while preventing other workstations to access the media.
Address
MAC address field contains the address of a different type, address type depends on the type of transmission frame.
Address 1 representative of an end address of the received frame. In some cases, the destination is the receiving end
* Refers to the destination station is responsible for processing the network layer packet frame, and the receiver is responsible for decoding the radio station of the 802.11
* If Address1 is set to broadcast or multicast address, you must also check the BSSID. Workstations will only answer from a broadcast or multicast address with the BSS, as different from other BSS is ignored
Transmitting end address Address 2 is used to transmit response information. In some cases, the sender is the source address, but not exclusively so.
Generating the source address is the network layer protocol packet in a frame of the workstation, and is responsible for the transmitting side transmits frames to the radio link
Address 3 is a base station and a transmission system for filtering purposes, but the usage of this bit, depending on the type of network used
Address 4 is generally not in use, used only in the wireless transmission system WDS
Sequence control bits
This bit length 16bit, used recombinant fragment frame and discarding duplicate frames. It consists of 4-bit fragment number (segment number) bits and the composition of 12bit sequence number (sequence number).
Sequence number: equivalent has been passed to frame counter 4096 takes the touch. This counter starting from the 0, MAC will process each packet accumulated upper 1. If the retransmission occurs, the sequence number unchanged, facilitating the processing frame discard of duplicate frames. The main frame is sent by our number of frames retransmitted brushing election, to ensure the correctness of the frame.
Segment number: an upper layer packet is used in the cutting process, the first segment number 0, followed sequentially incremented by 1 each segment, are easily re-frame group. All frames are fragments having the same sequence number if it is a retransmission frame, the sequence number will not change.
The frame body
Frame Body frame body position, also referred to as data bits, the upper layer is responsible for transmitting data between workstations, 802.11 data can be transmitted up to the upper layer 2312 bit groups.
Frame check sequence
Frame Check sequence简称FCS，FCS让工作站得以检查所收到的帧的完整性。
当帧送至无线界面时，会先计算FCS，然后再由RF或IR链路传送出去。接收端随后会为所收到的帧计算FCS，然后与记录在帧中的FCS做比较。802.11网络中，通过完整性检验的帧还需接收端送出应答，例如：接收无误的数据帧必须得到正面应答，否则就必须重传。对于未能通过FCS的帧，802.11并未提供负面应答机制；在重传之前，工作站就必须等候应答超时。
802.11帧类型
Type类型与Sub Type子类型用来指示所使用的帧类型。
Type用以区分帧类型：
管理帧的Type值为：00
控制帧的Type值为：01
数据帧的Type值为：10
帧类型11保留，尚未使用
Sub Type指各帧类型中详细使用帧类型。
数据帧
数据帧会将上层协议的数据置于帧主体加以传递，会用到哪些位，取决于该数据帧所属的类型。
* Frame Control帧控制：每个帧控制bit都可能影响到MAC标头其他位的解读方式。值得注意的是地址位，它们的意义将因ToDS及FromDSbit的值而异。
DS Distribution system分布式系统是接入点间转发帧的骨干网络，因此通常称为骨干网络，一般可理解为以太网
SA源地址，DA目的地址，RA接收端，TA发送端
以下4中情况分别对应上表中情况
上图中，源端和发送端都是终端，目的端和接收端都是AP，信号从终端发出，希望关联AP，BSSID用以过滤非此BSS的STA连接
上图中源端和发送端都是终端，接收端是AP，信号是从无线链路向AP发送，所以To Ds为1，发送的目的端为与AP相连的交换机
上图源端是与AP相连的交换机，发送端是AP，信号从AP向无线链路发送，所以From DS 为1，目的端和接收端为STA
上图为WDS模型，上表中第4列只在这种模型中会有，即四个地址位都被使用，WDS模型既有无线链路向AP发送信号，又有AP向无线链路发送信号，故ToDS和From DS均为1
控制帧
控制帧均使用相同的Frame Control位
Type：控制帧的类型标识码为01，所有控制帧均使用此标识码
To Ds和From DS：控制帧负责处理无线介质的访问，因此只能够由无线工作站产生，传输系统并不会接收控制帧，因此这两个必然为0.
More Fragments：控制帧不可分割，必然为0
Retry：必然为0
More Data：此位只用于管理数据帧，在控制帧中必然为0
Protected Frame：控制帧不会经过加密，故此bit必然为0
Order：控制帧是基本帧交换程序的组成要件，因此必须依序发送那个，所以必然为0
控制帧-PS-Poll
当客户端从省电模式中苏醒，便会发送一个PS-Poll帧给AP，以取得任何暂存帧。PS-Poll帧的格式如下
Frame Control：帧的sub type设定为1010，代表PS-Poll帧
AID连接识别码：PS-Poll帧将会以MAC标头的第三与第四bit来代表连接识别码association ID。连接识别码是基站所指定的一个数值，用以区别各个连接。将此识别码置入帧，可以让AP找出为其客户端所暂存的帧
BSSID：包含发送端目前所在BSS的BSSID
Transmitter Address发送端地址：此为PS-Poll帧之发送端的地址。
控制帧-RTS
当AP向某个客户端发送数据的时候，AP会向客户端发送一个RTS报文，这样在AP覆盖范围内的所有设备在收到RTS后都会在指定的时间内不发送数据。RTS帧可用来取得介质的控制权，以便传输帧。RTS帧格式如下：
Frame Control：帧的subtype设定为1011，代表RTS帧
Duration持续时间：RTS会试图预定介质使用权，供帧交换程序使用，因此RTS帧发送者必须计算RTS帧结束后还需要多少时间。传输所需要的微秒数经过计算后会置于Duration位。假如计算的结果不是整数，就会被修正为下一个整数微秒。
Receiver Address：接收端地址，接收RTS帧的工作站地址
Transmitter Address：发送端地址，RTS帧的发送端地址。
例如：
控制帧-CTS
CTS允许发送，目的客户端收到RTS后，发送一个CTS报文，这样在该客户端覆盖范围内的所有设备都会在指定的时间内不发送数据。CTS会令附近的工作站保持沉默，从而获取介质的控制权。其格式如下：
Frame Control：帧的subtype设定为1100，代表CTS帧
Duration持续时间：用来应答RTS时，CTS帧的发送端会以RTS帧的duration值作为持续时间的计算基准。RTS会为整个RTS-CTS-Frame-ACK交换过程预留介质使用时间。
Receiver Address：接收端地址，CTS帧的接收端即为RTS帧的发送端
控制帧-ACK
应答ACK：每个发送的单播报文，接收者在成功接收到报文后，都要发送一个应答ACK进行确认。
Frame Control：帧的subtype设定为1101，代表ACK帧
Duration持续时间：依照ACK信号在整个帧交换过程中位居何处，在完整的数据帧及一连串帧片段的最后一个片段中，duration会被设定为0
Receiver Address：由所要应答的发送端帧复制而来
管理帧
管理帧目的是通过帧的使用，为网络提供相对简单的服务
* Beacon帧（信标帧）
Beacon帧主要来声明网络的存在。定期传送的信标可以让移动式工作站得知该网络的存在，从而调整加入该网络所必须的参数。
基础结构网络中，接入点负责传送Beacon帧
* Probe Request、Probe Response帧
工作站通过Probe Request帧来扫描所在区域内的802.11网络
若Probe Request帧探查的网络与之兼容，该网络就回复Probe Response帧给予响应
* Authentication帧、Deauthentication
工作站通过共享密钥以及Authentication帧进行身份验证
Deauthentication解除身份验证帧则用来终结认证关系
* Association Request帧
一旦工作站找到兼容网络并且通过身份验证，便会发送Association Request关联请求帧试图加入网络
* Disassociation帧
取消关联帧用关联来终结一段关联关系
* Reassociation Request帧
位于相同ESS中，当在不同的BSS之间移动的工作站若要再次使用分布式系统DS，必须与网络重新关联，区别于关联请求帧的是：它包含工作站当前所关联的接入点地址
* Association Response帧与Ressociation Response帧
当工作站试图连接接入点时，接入点会回复一个Association response帧或Reassociation response帧，响应过程中，接入点会指定一个Association ID（关联标识符）