ExamFinch.com My Study

Study guide

8.1 Management, Control and Data Frames

Practice this exam

CWNA Certified Wireless Network Administrator CWNA-109

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 CWNA-109 Knowledge Domains and Study Strategy

2 RF Fundamentals

2.1 RF Waves, Propagation, Gain and Loss 2.2 Reflection, Multipath, VSWR and Free-Space Path Loss 2.3 RF Units and the Rule of 10s and 3s

3 RF Measurement and Antenna Systems

3.1 Noise Floor, SNR, RSSI and EIRP 3.2 Line of Sight, Fresnel Zone, Polarization and MIMO 3.3 Antenna Types, Charts, Cables and Lightning Protection

4 Industry Bodies and Legacy PHY

4.1 Industry Organizations and OSI Layers 4.2 Legacy 802.11 PHY Standards 4.3 Spread Spectrum, Modulation and MCS

5 Modern 802.11 PHY and Channel Concepts

5.1 Wi-Fi 4 HT and Wi-Fi 5 VHT 5.2 Wi-Fi 6 and Wi-Fi 6E High Efficiency 5.3 Primary Channels, OBSS, Throughput and Guard Interval

6 Spectrum Rules and WLAN Use Cases

6.1 Frequency Bands, DFS and Transmit Power Control 6.2 WLAN, Bridging, Peer-to-Peer and Mesh

7 802.11 Service Sets and Framing

7.1 Stations, BSS, ESS and the Distribution System 7.2 MSDU, MPDU, PSDU, PPDU and Aggregation 7.3 MAC Frame Format and Addressing

8 Frame Types, Discovery, and Association

8.1 Management, Control and Data Frames 8.2 Scanning, Authentication and Association

9 Channel Access, MAC Operations, and Devices

9.1 DCF, EDCA, RTS/CTS and Interframe Spaces 9.2 Roaming, Power Save and Protection Mechanisms 9.3 Access Points, Controllers and Client Devices

10 PoE, Architectures, and Proprietary Features

10.1 Power over Ethernet, PSE and Power Budgets 10.2 Centralized vs Distributed Forwarding and Network Planes 10.3 Airtime Fairness, Band Steering and RRM

11 WLAN Design and Supporting Services

11.1 Data, Voice, Video and Legacy Client Design 11.2 High-Density, Location Services and Guest Access 11.3 DHCP, DNS, Time, VLANs and AAA

12 WLAN Security

12.1 Weak and Deprecated WLAN Security 12.2 AES, WPA2-Personal and WPA2-Enterprise 12.3 WPA3, SAE and Opportunistic Wireless Encryption 12.4 PMF, Fast Roaming, WIPS and Secure Management

13 RF Validation Surveys and Tools

13.1 Post-Implementation Validation Surveys 13.2 Application and Performance Testing 13.3 Validation Tools: Survey, Protocol and Spectrum

14 Interference, Troubleshooting, and Common Faults

14.1 Co-Channel Contention vs Adjacent Channel Interference 14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring 14.3 Common WLAN Faults and Hidden Nodes

8.1 Management, Control and Data Frames

Key Takeaways Explain This Topic AI

802.11 MAC frames fall into three Type families in Frame Control: Management (00), Control (01), and Data (10).

Management subtypes include Beacon, Probe Request/Response, Authentication, Association, Deauthentication, Disassociation, and Action.

Control subtypes include RTS, CTS, ACK, Block ACK (and Block ACK Request), and PS-Poll; ACK is control, not management.

Data subtypes include ordinary Data, QoS Data, Null, and QoS Null; Null frames are still the Data type even with an empty payload.

Deauthentication is a management notification that tears down 802.11 authentication; it is not a control handshake.

Last updated: September 2026

Independent ExamFinch teaching for CWNA-109 objective 3.4 is about which 802.11 MAC frame type does which job . Harborline Terminals' warehouse WLAN fails this objective in a packet capture when a technician sees a Deauthentication and calls it a control handshake, or sees an ACK and files it under management because "it manages delivery." Those two mistakes are the classic traps: Deauthentication is management. ACK is control.

Frame format and the four address fields belong with MAC addressing. This section assumes you can find Frame Control , Duration/ID , and the address list. What you must add is the Type / Subtype split and a working inventory of the frames the exam actually names.

Why the MAC splits frames into three types

Every 802.11 MAC Protocol Data Unit (MPDU) starts with a Frame Control field. Two bits named Type pick the family. Four bits named Subtype pick the specific frame inside that family. The three families CWNA-109 tests are:

  • Type bits Frame type Job in one sentence
  • 00 Management Find, join, leave, and steer the BSS; carry Information Elements
  • 01 Control Help deliver other frames: reserve airtime, acknowledge, poll for buffered data
  • 10 Data Carry MSDUs, or an empty payload used as a MAC signal

A fourth Type value ( 11 , Extension) exists in the standard for specialized PHYs. Do not let it steal the three-type story this objective tests.

Management, control, and data share a MAC header skeleton . What changes is subtype , which addresses appear , and whether a body exists . Control frames are usually short and have no Information Elements . Management frames are stuffed with tagged Information Elements : SSID, supported rates, RSN, HT/VHT/HE capabilities, TIM, country, BSS Load. Data frames carry the MAC Service Data Unit (MSDU) —or nothing, for Null .

Harborline's protocol analyzer color-codes these families. If you cannot predict the color before you click, you are not ready for items that mix a Beacon, an RTS, and a QoS Data frame in one capture.

Management frames: membership and BSS operation

Management frames do not carry user IP packets. They create and tear down the relationship between a station (STA) and an access point (AP) , and they advertise how the BSS works.

Beacon

An infrastructure AP transmits Beacon frames on a schedule. A common default beacon interval is 100 time units (TU) , about 102.4 ms , so Harborline's SSID "HL-YARD" is re-advertised on the order of ten times per second. A Beacon is a broadcast advertisement: timestamp for timing synchronization function (TSF) sync, beacon interval, capability information, SSID , supported and extended rates, DS Parameter Set (channel), Traffic Indication Map (TIM) for power-save, country, ERP/HT/VHT/HE operation, and often an RSN element describing AKM suites and ciphers. Independent IBSS stations also beacon. Passive scanning is "sit on a channel and wait for Beacons." If Harborline's AP is on channel 36 and a laptop dwells on 36 long enough, it learns the BSS without transmitting .

Probe Request and Probe Response

Probe Request is a station asking who is on this channel. It may use a wildcard SSID (broadcast discovery) or a specific SSID (directed discovery). Probe Response is the AP's answer, carrying much of the same BSS description as a Beacon. Active scanning is this pair. Harborline's laptop that must join quickly after sleep will probe . A radio that must stay quiet on a Dynamic Frequency Selection (DFS) channel may listen instead of probing.

Authentication

The Authentication management frame is 802.11 Authentication , a MAC state-machine step. It is not IEEE 802.1X. Open System Authentication is two frames: request, then a success response. Shared Key Authentication is the old four-frame WEP challenge exchange and is deprecated . When Open System is used with WPA2/WPA3, and how 802.1X fits after association, belongs with scanning and association. Here, remember the frame is management .

Association Request and Association Response

After 802.11 Authentication, the STA sends Association Request : capability information, listen interval, SSID, rates, RSN, and PHY capabilities (HT/VHT/HE). The AP returns Association Response with a status code and, on success, an Association ID (AID) . Reassociation Request and Reassociation Response exist for moving to another AP in the ESS; roaming MAC behavior is a later objective. Harborline's scanner is not in the BSS for Class 3 data until association succeeds.

Deauthentication and Disassociation

Disassociation ends association . In the classic three-state model the STA can remain 802.11-authenticated but unassociated. Deauthentication ends authentication , which also dumps association. Both carry a reason code . Both are notifications , not a handshake the other side can refuse. Deauthentication is still a management frame. Attackers historically flooded deauthentication because many networks did not protect management frames. Protected Management Frames (PMF) is a security-chapter countermeasure; it does not recategorize Deauthentication as control.

Action

Action (and Action No Ack) frames are the extensible management bucket. Categories you should recognize by job, not by memorizing every code point: spectrum management including Channel Switch Announcement , QoS admission, radio measurement, Fast BSS Transition, SA Query used with PMF, public action, and HT/VHT/HE action. If Harborline's DFS AP must leave a radar channel, clients learn from an Action frame, not from an ACK.

Loading diagram... 802.11 MAC Type field and the subtypes CWNA-109 names

Control frames: delivery helpers, not membership

Control frames do not join a BSS and do not carry an SSID Information Element. They assist the delivery of management and data frames. Duration values in many control frames drive virtual carrier sense (the network allocation vector, NAV ). Channel-access timers and RTS threshold policy belong with DCF/EDCA; this section's job is to name the frames and put them in the control family.

Control frame What it does Harborline instinct

RTS (Request to Send) Originator asks to reserve the medium for a coming frame exchange Used when a unicast frame exceeds the RTS threshold, or to reduce hidden-node collisions

CTS (Clear to Send) Receiver (or a CTS-to-self sender) grants/extends the NAV reservation Neighbors set NAV even if they cannot hear the original STA

ACK Confirms successful receipt of a unicast MPDU Control , not management. Broadcast/multicast data is typically not ACKed

Block ACK (BA) and Block ACK Request (BAR) Acknowledge a window of MPDUs for one traffic identifier Required story once A-MPDU aggregation is in play

PS-Poll Sleeping STA asks the AP for a buffered unicast MSDU; Duration/ID carries the AID Scanner wakes, polls, receives data, then may sleep again

ACK is the exam magnet. A unicast QoS Data frame that FCS-checks correctly is typically followed by an ACK control frame from the receiver. That ACK is not an Association Response, not an Action, and not a management "delivery confirmation." If Harborline's capture shows Data then a tiny frame with no body, look at Type: control , Subtype: ACK .

Block ACK is the aggregated cousin. 802.11n and later send A-MPDUs . The originator either sends an explicit BAR or uses a QoS Ack policy of Block ACK. The recipient returns a BA bitmap for that traffic identifier (TID) window instead of one ACK per MPDU. Block ACK is still control . Do not call the BA bitmap a data payload.

PS-Poll is the other control trap. A STA in power-save mode that sees its AID bit set in the Beacon TIM can send PS-Poll . The Duration/ID field is not a NAV duration in the usual sense; it carries the AID . The AP then delivers a buffered unicast frame (often with More Data set if more frames wait). Do not confuse PS-Poll with Null data. Null is Type Data. PS-Poll is Type Control.

RTS and CTS exist to set NAV around a frame exchange so hidden nodes stay quiet. CTS-to-Self is a protection trick you will meet with mixed PHYs. For this objective, lock the family: RTS and CTS are control .

Data frames: MSDUs, QoS Data, and Null

Data frames are how user traffic crosses the wireless link after association (Class 3 in infrastructure). Subtypes you must separate:

  • Data subtype Payload Typical use
  • Data MSDU Legacy non-QoS traffic
  • QoS Data MSDU plus a QoS Control field WMM/802.11e access categories, TID, Ack policy
  • Null (no data) Empty Signal Power Management bit, keep-alive, some roam hints
  • QoS Null Empty plus QoS Control Same signaling with a TID / queue context

QoS Data is still the Data type. Adding a QoS Control field does not move the frame into management or control. QoS Control carries TID (user priority 0–7 for ordinary QoS data), Ack policy (Normal ACK, No ACK, Block ACK), and AP-side hints such as end of service period (EOSP) or queue size. Harborline's voice handsets should show QoS Data with a voice TID, not Action frames for every RTP packet.

Null data is the empty-payload subtype. Technicians call it "keep-alive" or "power-save frame." The useful bit is often Power Management in Frame Control: set to 1 to tell the AP "buffer my unicast; I am sleeping," set to 0 to say "I am awake." Because there is no MSDU, people mis-file Null as management. Null is Data. A station that never sends Null or PS-Poll can still go to sleep incorrectly from the AP's point of view and look like it vanished.

Legacy PCF subtypes (Data+CF-Ack, CF-Poll, and friends) still exist in the subtype table. They are not the daily enterprise capture. Do not spend exam minutes there unless the item names PCF.

Which type does what — a Harborline capture

Walk one join-and-sleep cycle on HL-YARD:

AP Beacon (management) advertises SSID, rates, RSN, TIM.

Laptop Probe Request (management); AP Probe Response (management).

Authentication request and success (management) — Open System for WPA2.

Association Request and Association Response with AID (management).

After the 4-way handshake (security chapter), laptop sends QoS Data (data); AP returns ACK (control).

If the MSDU is large and RTS threshold is on, RTS then CTS (control) wrap the data.

Aggregated HT/VHT/HE bursts use Block ACK (control) instead of one ACK per MPDU.

Laptop sends QoS Null with Power Management = 1 (data) and sleeps.

Beacon TIM shows the AID; laptop sends PS-Poll (control); AP delivers buffered QoS Data (data) and ACK returns (control).

Security logout or a rogue flood: Deauthentication (management) with a reason code. Not RTS. Not ACK.

If Harborline's DFS AP must move channel, insert an Action Channel Switch Announcement (management) before beacons hop.

Frame classes: why data waits for association

The original 802.11 frame class rules still explain capture filters:

  • Station state Allowed classes What that means on HL-YARD
  • Unauthenticated, unassociated Class 1 Probe, Beacon, Authentication, some control (RTS/CTS/ACK)
  • Authenticated, unassociated Class 1 and 2 Association frames; still no ordinary ToDS/FromDS data
  • Authenticated, associated Class 1, 2, and 3 QoS Data in the BSS

You cannot send Harborline scanner IP traffic as 802.11 Data until the STA is associated . Control ACKs can still appear earlier because ACK is Class 1. That is another reason people mix ACK with "session management" — it shows up before association. It is still control .

Exam traps to say out loud

Deauthentication and Disassociation are management . Reason codes do not change the Type bits.

ACK and Block ACK are control . They confirm delivery; they do not join the BSS.

PS-Poll is control with AID in Duration/ID . Null is data with an empty body.

Action is management , including channel switch and SA Query.

QoS Data is data , not a fourth type.

Beacons and probes are management even when they feel like "control signaling" in English.

Name the Type first, then the Subtype. Harborline's tickets get shorter when the capture filter matches that sentence.