An 802.11 transmission, opened from the PPDU on the air down to individual
bits. One lane per layer — read downward it is decapsulation, the way a
capture is read; read upward it is encapsulation, the way the transmission
was built.
No frames match. Every filter above is a set of things to include —
an empty set includes nothing. Turn some back on, or
.
TCP over IPv4, in a protected QoS Data frame
The same chain, encrypted. Locked, this is what a sniffer without the passphrase actually gets — a fully readable MAC header and an opaque body. Unlocked, it reads all the way down to the application data.
Zoomed into — this layer at full
width, its components opened. Other layers are collapsed for context.
Everything here is true proportion on each lane's own
axis. Labels float above their field and step down a row only where they
would collide, so nothing is inflated to make its name fit. Zoom widens the
whole diagram together and scrolls sideways, which keeps the lanes aligned.
PHY802.11aµs
L-STF8 µsL-LTF8 µsL-SIG4 µsDATAvariable
SIGNAL field · 24 bits · b0 is the LSB, transmitted first
magnified — at true scale this sits 3.8%
into the lane and is only 0.95% of it wide
magnified — at true scale this sits 36.1%
into the lane and is only 2.78% of it wide
CWRb0ECEb1URGb2ACKb3PSHb4RSTb5SYNb6FINb7
The Data slot is open — nothing is stacked below this
lane yet. A truncated stack is a valid composition, not a broken
one.
Showing through . Deeper layers are
hidden, not absent — the octets are still in the frame, and the fields
below still exist. LLC and SNAP stay visible at L2
because IEEE 802.2 LLC is the upper sublayer of the data link layer, not
something above it.
How the layers combine
Each layer names the unit it receives from above differently from the unit
the layer above hands down. They are the same octets. Nothing is added
crossing a seam — the header you see appear was always inside the slot, and
only becomes visible when the next layer subdivides it.
PPDU= L-STF + L-LTF + L-SIG + DATA ⊃ PSDU
↓
the PSDU is the
MPDU —
same octets, different name
MPDU= FC + Dur + A1/RA + A2/TA + A3 + SeqCtl + QoS + Body + FCS
↓
the MSDU is
wrapped by CCMP-128 protection — a header and trailer
around the same payload
CCMP= CCMP Hdr + Ciphertext + MIC
↓
the MSDU is the
LPDU —
same octets, different name
byte order flips to network order ; bit 0 moves to the other end of the octet
Structure is a property of the format; values are a property of the
capture. Everything above is named and positioned whether or not you hold
the passphrase — only the octets below are withheld.
🔒
Encrypted — values withheld
64 octets at offset 34 are
CCMP-128 ciphertext. Every field below is still
named, sized and positioned — that is the format, not the capture.
Only the values are unavailable, which is exactly what a sniffer
without the passphrase gets.
The passphrase reveals octets this site already holds. It does not derive a key or run AES — deriving one for real needs a four-way handshake, which needs management frames to exist first.
That passphrase does not match this network.
The octets
110 octets, exactly as a capture tool would show them —
most significant bit leftmost, which is the opposite direction from the
bit strips above. Click a field to highlight its octets, or an octet to
find its field.
0000
·A,···^·S···^·S·
0010
··^·S·@········
0020
········g··q0···
0030
··F···}···Gi····
0040
··e···~····PY·p;
0050
·CXdw·\·····-··
0060
ygk··8·····X··
The shaded span is ciphertext — 64 octets
from offset 34. Its structure is known and rendered
above; only these values are unavailable.
The shaded span is the 64 octets that
were ciphertext, now shown in the clear. Same offsets, same fields —
the lock never changed the structure, only what you could read.
A shaded octet is shared by more than one field — several sub-octet
fields live inside it, so highlighting the byte overstates any one of them.
Every field, and what contains what
The same frame as a hierarchy rather than a scale drawing. Proportion is
useful for airtime and useless for structure — a one-bit flag and a
1500-octet payload matter equally here and not at all equally above.
Structure
Every field in this transmission and what contains what — one hierarchy
from the PPDU on the air down to the application's bytes. Indentation is
containment. 101 fields, 101 unverified.
Accuracy
101 of 101 nodes on this page are
unverified. Every field carries a clause reference, but those
references have not yet been checked against the standard by a human. A
node marked ? is a claim, not a fact.
This is what the accuracy process is supposed to look like early on: a
mistake degrades to a visible caveat rather than a silent error. Baseline
edition 802.11-2024.