A real-life situation
A packet capture from a laptop shows hundreds of frames before any user data appears: beacons, probes, authentication, association, then a four-message key exchange. Then, for every data frame, a tiny ACK. None of that exists on Ethernet. Wi-Fi shares one open radio medium, so it needs extra frames to find networks, join them safely and take turns.
The 802.11 header
On Ethernet, a frame has a source and a destination. On Wi-Fi the AP sits in the middle, so the header also names the radio that sends this hop (transmitter) and the one that should receive it (receiver). Two bits in Frame Control, To DS and From DS (DS = distribution system, the wired network), say which way the frame is going and so what each address means:
| Direction | To DS / From DS | Address 1 | Address 2 | Address 3 |
|---|---|---|---|---|
| Client → AP → wired network | 1 / 0 | BSSID (the AP) | Client | Final destination |
| Wired network → AP → client | 0 / 1 | Client | BSSID (the AP) | Original source |
| Management frames | 0 / 0 | Receiver | Transmitter | BSSID |
Three types of frame
| Type | Purpose | Common subtypes |
|---|---|---|
| Management | Find, join and leave a WLAN | Beacon, probe request/response, authentication, association request/response, reassociation, disassociation, deauthentication |
| Control | Manage access to the air | ACK, RTS (request to send), CTS (clear to send), block ACK, PS-Poll |
| Data | Carry user traffic | Data, QoS data, null data (to signal power saving) |
Taking turns: CSMA/CA
All devices in a cell share one channel, and a radio can't listen while it transmits, so Wi-Fi avoids collisions instead of detecting them:
- Listen. Is anyone transmitting? The radio checks the air and its NAV timer, set from the Duration field of frames it has heard.
- Wait. When the air is free, wait a fixed gap (DIFS), then a random backoff, so two waiting devices don't start together.
- Send the frame.
- Get an ACK. The receiver replies after a short gap (SIFS). No ACK means a lost frame: retry with a longer backoff.
Two clients on opposite sides of an AP may not hear each other (the hidden node problem). Optionally, a client first sends a short RTS; the AP answers with a CTS that every client hears, and they all stay quiet for the time it announces.
Joining a WLAN
A client finds networks passively by listening for beacons, or actively by sending probe requests. Then it joins in a fixed order:
- BeaconHere is SSID Staff, my data rates and my security (WPA2/WPA3).Beacon from AP1 to Laptop.
- Is Staff here? What do you support?Probe from Laptop to AP1.Probe
- Probe respYes: here are my capabilities.Probe resp from AP1 to Laptop.
- Authentication802.11 open authentication: just a formality. Real security comes later.
- Please authenticate me (open system).Auth from Laptop to AP1.Auth
- AuthSuccess.Auth from AP1 to Laptop.
- AssociationThe client asks to join; the AP accepts and gives it an association ID (AID).
- Please associate me; here are my capabilities.Assoc req from Laptop to AP1.Assoc req
- Assoc respAccepted, your AID is 1.Assoc resp from AP1 to Laptop.
- Security802.1X/EAP (Enterprise) or nothing extra (Personal), then the four-way handshake creates the encryption keys.
- EAPOL 1–4Four-way handshake: both sides prove they know the key and derive fresh session keys.EAPOL 1–4 from AP1 to Laptop.
- ConnectedEncrypted data frames can flow; the client now asks DHCP for an IP address.
Why it works this way
Radio is a shared, unreliable medium where anyone in range can listen. That explains the design: beacons and probes because there is no cable to show what is connected; acknowledgements because frames are often lost; collision avoidance because collisions can't be heard; and a key exchange because anyone could capture the frames.
Common mistakes
- Thinking 802.11 open authentication is security. It authenticates nothing; WPA2/WPA3 provides security.
- Assuming Address 1 is always the destination. It is the receiver of this hop, often the AP.
- Confusing CSMA/CA (Wi-Fi, avoids collisions) with CSMA/CD (old half-duplex Ethernet, detects them).
💡 Exam tip: know the three frame types with an example each (beacon, ACK, data) and the join order: probe → authentication → association → security handshake.
Key takeaways
- The 802.11 header has up to four addresses; To DS and From DS set what each one means.
- Management frames join and leave, control frames manage the air, data frames carry traffic.
- CSMA/CA: listen, wait a random backoff, send, expect an ACK. RTS/CTS helps with hidden nodes.
- Joining: beacon or probe, open authentication, association, then 802.1X and/or the four-way handshake.
Check yourself
Which frame type is a beacon?
A laptop sends a frame through an AP to a server on the wired network. What is Address 1?
In what order does a client join a WPA2-Personal WLAN?
Why does Wi-Fi use collision avoidance rather than detection?