In an 802.11 network secured with WPA2, the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is used for encryption. CCMP encrypts the payload of the data frame, which is referred to as the Frame Body. This Frame Body contains the MAC Service Data Unit (MSDU), which encapsulates the upper-layer data, including the Logical Link Control Protocol Data Unit (LLC PDU). The MAC Header is intentionally left unencrypted (in cleartext) to allow network infrastructure devices, such as access points, to read critical addressing and control information for frame processing and forwarding. The Frame Check Sequence (FCS) is also not encrypted; it is recalculated after the payload has been encrypted.

A. The MAC Header is not encrypted; it must remain in cleartext for network devices to read addressing and control information.

B. Excluding the LLC PDU would mean the actual user data is not protected, which defeats the entire purpose of encryption.

D. The whole MPDU is not encrypted because the MAC Header is transmitted in cleartext, and the FCS is recalculated post-encryption.

1. IEEE Std 802.11™-2020, "IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications."

Section 12.5.3.3, "CCMP MPDU format" and Figure 12-16: This section explicitly illustrates the CCMP-encrypted MPDU. The figure shows the MAC Header is not part of the encrypted portion. The encryption is applied to the original plaintext data (the MSDU, which forms the frame body) and the Message Integrity Code (MIC).

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7, Section 7.3.4, "802.11 Security": This section describes the principles of 802.11i (the standard that WPA2 implements). It clarifies that encryption services are provided for the data payload of the frame, while the MAC header fields such as addresses and sequence numbers are sent in the clear.

In the 802.11 frame encapsulation process, the MAC sublayer creates the MAC Protocol Data Unit (MPDU) and passes it to the Physical (PHY) layer. The PHY layer treats this incoming MPDU as its payload, which is called the PHY Service Data Unit (PSDU). The PHY layer's primary function is to prepare this data for transmission over the air. To do this, it prepends a Preamble (for synchronization) and a PHY Header (also called the PLCP Header, containing transmission parameters like data rate and length) to the PSDU. The resulting complete unit, ready for transmission, is the PHY Protocol Data Unit (PPDU).

A. LLC: The Logical Link Control (LLC) sublayer operates above the MAC sublayer and is not involved in the creation of the physical layer frame.

B. Network: The Network layer (Layer 3) handles logical addressing (e.g., IP) and routing, passing data down to the Data Link layer (MAC/LLC).

D. MAC: The MAC layer adds the MAC header to create the MPDU. It provides the PSDU to the PHY layer but does not add the PHY header itself.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016). Section 17.2.2, "PPDU format." The diagrams and descriptions in this section illustrate that the Physical Layer Convergence Procedure (PLCP) Preamble and PLCP Header are added to the PSDU at the physical layer to form the PPDU.

2. Carnegie Mellon University, ECE 18-759: Wireless Networks, Lecture 6: IEEE 802.11 Physical Layer. Slide 10, "PLCP Frame Format." The slide explicitly shows a diagram where the "PLCP Preamble" and "PLCP Header" are prepended to the "PSDU (from MAC)" by the PHY layer. This demonstrates the PHY layer's responsibility for adding its own header.

The Arbitration Interframe Space (AIFS) is a fundamental component of the Enhanced Distributed Channel Access (EDCA) mechanism, which was introduced by the IEEE 802.11e amendment to provide Quality of Service (QoS) on Wi-Fi networks. Unlike the fixed Distributed Coordination Function Interframe Space (DIFS) used in legacy networks, AIFS is a variable time interval that a station must wait before contending for the medium. The duration of the AIFS depends on the Access Category (AC) of the data to be transmitted (e.g., Voice, Video, Best Effort, Background). Higher-priority traffic is assigned a shorter AIFS, giving it a statistical advantage in accessing the wireless medium over lower-priority traffic.

A: AIFS was introduced by 802.11e, not 802.11n, and is a widely implemented parameter within the EDCA access method as part of Wi-Fi Multimedia (WMM) certification.

C: AIFS is a MAC-layer timing parameter for medium contention, not a PHY-layer aggregation method. Aggregation is handled by mechanisms like A-MSDU and A-MPDU.

D: This describes power-saving functions. AIFS is related to medium access prioritization, not the duration a station can be in a low-power (sleep) state.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 10.22.2.3 (EDCA timing): "A non-AP QSTA using the EDCA shall transmit a frame with a particular user priority (UP) when its carrier-sense mechanism determines that the medium is idle at the end of an AIFS period for that UP... The AIFS for a particular AC (AIFS[AC]) is defined by the following formula: AIFS[AC] = AIFSN[AC] × aSlotTime + aSIFSTime". This confirms AIFS is a variable interframe space dependent on the Access Category (AC).

2. Carnegie Mellon University, ECE Course 18-759: Wireless and Mobile Networking, Lecture 10: MAC Layer (Part 3).

Slide 15 ("EDCA (Enhanced Distributed Coordination Access)"): This slide explicitly states, "DIFS is replaced by AIFS (Arbitration Inter-Frame Spacing) whose value depends on the traffic class." It shows a diagram where higher priority classes (Voice, Video) have a shorter AIFS than lower priority classes (Best Effort, Background), illustrating how AIFS is used for prioritization.

3. Bianchi, G. (2000). Performance analysis of the IEEE 802.11 distributed coordination function. IEEE Journal on selected areas in communications, 18(3), 535-547. https://doi.org/10.1109/49.840210

While this paper predates 802.11e, it provides the foundational analysis of DCF and DIFS. Later works that analyze 802.11e, such as those by Mangold et al., build upon this to show how AIFS replaces DIFS to enable service differentiation, reinforcing that AIFS is an evolution of the interframe space concept for QoS. (Note: This reference provides context for the concept AIFS replaced).

In an 802.11ac/ax network configured for wide channels (40/80/160 MHz), the total bandwidth is comprised of a single "primary" 20 MHz channel and one or more "secondary" 20 MHz channels. All management frames (e.g., Beacons, Probe Responses) and control frames must be transmitted on the primary 20 MHz channel. This channel is also used for contention (e.g., RTS/CTS) and for communication with legacy clients that do not support wider channels. Consequently, the primary channel will always exhibit higher airtime utilization than the secondary channels, which are used opportunistically for wide-channel data transmissions. The observation is a normal characteristic of 80 MHz operation.

A. The described behavior is a fundamental and expected characteristic of 80 MHz operation, not a sign of misconfiguration.

B. While non-Wi-Fi interference can cause performance issues, the specific pattern of higher utilization on only the primary channel is normal Wi-Fi protocol behavior.

D. If RRM had selected a 20 MHz channel, the AP would only be operating on that single channel, not an 80 MHz channel with varied utilization.

1. CWNP, LLC. (2021). CWAP-404 Certified Wireless Analysis Professional Official Study Guide. Sybex. In Chapter 5, "MAC Layer Analysis," the section on "VHT (802.11ac) MAC" explains that the primary 20 MHz channel is used for all management and control frames, leading to higher activity on that specific channel segment within a wider channel bond.

2. IEEE Std 802.11™-2020. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. In Clause 22.3.13, "Channelization," the standard defines the primary channel for VHT (802.11ac) operations and specifies its mandatory use for certain frame types, which inherently concentrates traffic on it.

3. Coleman, D. D., & Westcott, D. A. (2021). Certified Wireless Network Administrator CWNA-108 Official Study Guide. Sybex. Chapter 10, "802.11ac," details the channel-bonding mechanisms, explicitly stating that the primary channel carries the BSS's beacon frames and is the main channel for contention, explaining the higher utilization.

The 4-Way Handshake establishes the encryption keys used for a secure Wi-Fi session. In Message 3, sent from the Authenticator (AP) to the Supplicant (client), the Group Temporal Key (GTK) is transmitted. By this stage, both the AP and the client have independently derived the Pairwise Transient Key (PTK). The AP uses a portion of the PTK, specifically the Key Encryption Key (KEK), to encrypt the GTK before sending it. The client then uses its copy of the KEK to decrypt the GTK. The GTK is necessary for the client to decrypt broadcast and multicast traffic sent by the AP to all connected devices.

A. PMK: The Pairwise Master Key (PMK) is the initial shared secret and is used as an input to create the PTK; it is never transmitted during the handshake.

B. PTK: The Pairwise Transient Key (PTK) is derived independently by both the client and the AP using shared information; it is never transmitted across the wireless medium.

C. GMK: The Group Master Key (GMK) is a key held exclusively by the Authenticator (AP) to generate new GTKs. It is never distributed to clients.

1. IEEE Std 802.11™-2020. IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. Section 12.8.2.3, "The 4-way handshake," states: "Message 3... The Authenticator sends this message to the Supplicant. It includes the ANonce and the GTK... The Key Data field is encrypted using the KEK derived from the PTK."

2. Cisco. Understand the 4-Way Handshake in a WPA2-PSK network. (2023). This document details the handshake process, stating for Message 3: "In Message 3, the AP sends the GTK (Group Temporal Key) to the client. The GTK is encrypted by the use of the KEK."

3. Moore, A. W. (2017). Computer Networking, Lecture 16: Wireless Security. University of Cambridge, Department of Computer Science and Technology. Slide 29, "IEEE 802.11i: 4-way handshake," shows the content of Message 3 as "{GTK}KEK", indicating the GTK is encrypted with the KEK. Available at: https://www.cl.cam.ac.uk/teaching/1718/CompNet/slides/lec16.pdf

In the IEEE 802.11 architecture, data encapsulation occurs as data moves down the protocol stack. The Physical (PHY) layer receives a data unit from the MAC layer, which is referred to as the PHY Service Data Unit (PSDU). The PHY layer's Physical Layer Convergence Procedure (PLCP) sublayer then prepends a preamble and a PHY header to this PSDU. This newly created data unit, which includes the PHY-level framing and is ready for transmission over the wireless medium, is called the PHY Protocol Data Unit (PPDU).

A. MPDU: The MAC Protocol Data Unit (MPDU) is created by the MAC layer, not the PHY layer, by adding a MAC header to the MSDU.

B. PSDU: The PHY Service Data Unit (PSDU) is the payload that the PHY layer receives from the MAC layer; it is not the final framed unit created by the PHY.

C. MSDU: The MAC Service Data Unit (MSDU) is the data payload from the upper network layers before any 802.11 MAC or PHY headers are added.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems—Local and Metropolitan Area Networks—Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 17.2.2 (PLCP sublayer): States, "The PLCP sublayer adds a preamble and a PHY header to the MPDU to create the PLCP protocol data unit (PPDU)." (Note: The PSDU is the MPDU from the MAC layer's perspective).

Figure 17-2 (PPDU general frame format): Visually depicts the PPDU as being composed of the PLCP Preamble, PLCP Header, and the Data field (which is the PSDU).

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7, Section 7.3 (IEEE 802.11 Wireless LANs): This chapter describes the 802.11 frame structure, explaining that the PHY layer takes the MAC frame (MPDU) and adds its own header and preamble to create the physical-layer frame (PPDU) for transmission. This aligns with the standard's definition of encapsulation.

3. University of California, Santa Barbara, Courseware (CS 176A, Introduction to Computer Communication Networks).

Lecture Slides on "Wireless and Mobile Networks": These materials typically illustrate the 802.11 frame encapsulation process, showing the progression from MSDU to MPDU at the MAC layer, and finally to PPDU at the PHY layer, clarifying that the PPDU is the unit created by the PHY layer for transmission.

A Probe Request frame is transmitted by a station (STA) during active scanning to discover nearby wireless networks. When the SSID information element within this frame has a length of zero, it is referred to as a "null SSID" or "wildcard" probe. This specific type of Probe Request is a general broadcast inquiry, asking any Access Point (AP) that receives it to reply with a Probe Response. This mechanism allows the client STA to efficiently build a comprehensive list of all available Basic Service Sets (BSSs) within its range, rather than searching for a single, pre-configured network.

A. Promiscuous mode is a passive listening configuration for network analysis; it does not dictate the content of frames the STA actively transmits.

B. A null SSID probe is a standard discovery method in infrastructure mode and is not an exclusive indicator of a STA operating in Ad-Hoc (IBSS) mode.

C. A disabled WLAN adapter is incapable of transmitting any frames, including the Probe Request frame that was observed.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 11.1.3.2.1, "Active scanning": "To find any AP, the STA transmits a Probe Request frame with the SSID field in the SSID element set to the broadcast SSID (i.e., the length of the SSID field is 0)."

Section 9.4.2.2, "Probe Request frame format": "The SSID element indicates the desired SSID. A STA may set the SSID element to the broadcast SSID (the SSID element with the SSID field of length 0) to request a response from any AP."

2. Carnegie Mellon University, School of Computer Science Courseware. "15-441: Computer Networks, Lecture 23: Wireless," by Srinivasan Seshan.

Slide 21, "Joining a Network: Scanning": The slide on Active Scanning describes the process: "Probe request sent on each channel... SSID = broadcast... APs send probe response...". This confirms that a broadcast SSID (null SSID) is used to discover available APs.

The fundamental difference between a legacy Data frame and a QoS-Data frame, as defined by the IEEE 802.11e amendment, is the inclusion of a 2-byte (16-bit) QoS Control field in the MAC header. This field is present only in frames with the QoS subtype. It contains several subfields, most notably the Traffic Identifier (TID), which maps the frame to one of eight User Priorities (UPs). These UPs are then mapped to specific Access Categories (ACs) for prioritized channel access using EDCA (Enhanced Distributed Channel Access). The presence of this field is the defining characteristic that enables MAC-layer Quality of Service.

A. Differentiated Services Code Point (DSCP) is a Layer 3 marking in the IP header, not a field within the 802.11 MAC frame header.

B. The QoS Information Element is used in Management frames (e.g., Beacons) to advertise QoS capabilities, not within individual Data frames.

C. An 802.1Q VLAN tag is a Layer 2 mechanism for wired Ethernet and is not a native component of the 802.11 MAC header.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016). Section 9.3.2.1, "Data frame format," states: "The QoS Control field is present when the QoS subfield of the Subtype field is 1." Figure 9-28, "MAC frame format for QoS Data frames," visually depicts the location of the QoS Control field within the MAC header.

2. Coleman, D. D., Westcott, D. A., & Harkins, B. A. (2021). Certified Wireless Analysis Professional (CWAP) Official Study Guide: Exam CWAP-404 (2nd ed.). Wiley. Chapter 4, "802.11 MAC Architecture," in the section "QoS Data Frames," explains that the key differentiator for these frames is the 16-bit QoS Control field, which carries the priority value for the frame.

3. Hiertz, G. R., Denteneer, D., Stibor, L., Zang, Y., Costa, X. P., & Walke, B. (2010). The IEEE 802.11s MAC layer management and the mesh deterministic access. IEEE Wireless Communications, 17(1), 54-62. https://doi.org/10.1109/MWC.2010.5416349. In Section II.A, "The 802.11e QoS Facility," the paper states, "The main enhancement of 802.11e is the introduction of a new data frame format, the QoS data frame, which contains a QoS control field in its MAC header."

The primary function of 802.11 Management frames is to establish, maintain, and terminate sessions within a Basic Service Set (BSS). These frames are not used for carrying user data but are essential for the lifecycle of a wireless connection. Key examples include Beacon frames for announcing a network's presence, Probe Request/Response frames for discovering networks, Authentication and Association frames for joining a network, and Disassociation/Deauthentication frames for leaving a network. Collectively, these functions constitute the management of the BSS.

A. Prioritize network administration traffic: Traffic prioritization is a Quality of Service (QoS) function, which is primarily handled by fields within 802.11 Data frames, not by Management frames.

B. Communicate configuration changes between WLAN controller and APs: This communication typically occurs over the wired distribution system using a specific protocol like CAPWAP, not through standard 802.11 Management frames over the air.

D. Manage the flow of data: Managing the flow of data on the wireless medium, including access contention and acknowledgments, is the role of 802.11 Control frames (e.g., RTS, CTS, ACK).

1. IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. In Section 9.2.4, "Management frames," it states, "Management frames are used for the management of the MAC sublayer." The subsequent subsections (9.2.4.1 through 9.2.4.19) detail frames like Beacons, Probes, and Association, all of which manage the BSS.

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 7, Section 7.3.2, "The IEEE 802.11 MAC Protocol," the text distinguishes the three frame types, explaining that Management frames are used for "associating and disassociating with an AP."

3. Stanford University. (2019). CS144: Introduction to Computer Networking, Lecture 15: Wireless. Retrieved from https://web.stanford.edu/class/cs144/lectures/15-wireless.pdf. On slide 21, the lecture notes explicitly state that Management frames are used to "join and leave networks, and to move associations from one AP to another," which are core functions of managing a BSS.

The 802.11 Frame Control field is a 16-bit (2-byte) field that is present at the beginning of every 802.11 MAC header. This field is composed of multiple subfields that define the protocol version, frame type, subtype, and other specific characteristics. Several of these subfields are single-bit flags that indicate a particular state or attribute. These flags include To DS, From DS, More Fragments, Retry, Power Management, More Data, Protected Frame, and Order. Each flag, when set to 1, signals a specific condition, such as the frame being destined for the Distribution System (To DS) or being a retransmission (Retry).

A. All 802.11 frame types (Management, Control, and Data) contain a Frame Control field; it is a fundamental component of the MAC header.

B. The Duration/ID field, which is a separate field following the Frame Control field, is used to communicate the duration value.

D. The Frame Control field's value changes constantly to reflect the specific type, subtype, and attributes of each transmitted frame.

1. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11-2020. Section 9.2.4.1, "Frame Control field," pp. 678-681. This section explicitly details the structure of the Frame Control field, showing its various subfields, including the multiple 1-bit flags.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 6, "The Link Layer and LANs," Section 6.3.2, "802.11 Wireless LANs," describes the 802.11 frame structure, illustrating the Frame Control field and its constituent subfields and flags.

3. University of California, Santa Barbara, Department of Computer Science. (n.d.). CS 176B: Network Computing - Lecture 10: Wireless and Mobile Networks. Retrieved from https://www.cs.ucsb.edu/~ebelding/courses/176b/w18/lectures/10Wireless.pdf. Slide 21, "802.11 MAC Frame," provides a clear diagram of the Frame Control field, breaking it down into its subfields and identifying the 1-bit flags.