The extension mechanism that has carried 802.11 through twenty-five years of amendments. Each one announces itself with an identifier and a length, so a station that meets an element it does not recognise skips exactly that many octets and carries on — which is why new capabilities can be added without breaking old stations.
8 elements, 39 fields. The identifier is one octet, so there are 256 of them and this holds 8 — the ones the frames here actually carry. Element ID 255 introduces a second identifier in the body, which is how the space was extended once it ran out; none of those are authored yet. All 8 are unverified.
No elements match. Every filter above is a set of things to include — an empty set includes nothing.
The network name. Element ID zero, and by convention the first element in every beacon.
A zero-length SSID is not a bug: it is how an AP hides its name, and how a station asks "who is out there?" in a wildcard probe. The name is octets, not text, so nothing stops it containing bytes that do not render.
| Element ID | 1 octet | Identifies which element this is. Zero here. |
| Length | 1 octet | The length of everything after this octet, in octets. |
| SSID | variable | Zero to 32 octets of network name. |
Carried in Assoc Request, Beacon, Probe Request, Probe Response · cited to 802.11-2024 §9.4.2.2
Which data rates the BSS supports, and which of them a station must support in order to join at all.
The element behind every "disable low rates" recommendation. Each octet's top bit marks the rate as BASIC — mandatory to join — and the rest give the rate in half-megabit units. Removing 1 and 2 Mb/s from the basic set is what keeps 802.11b stations off a network, and it is visible right here.
| shared | Identifies which element this is. One here. | |
| shared | ||
| Rates | variable | One octet per rate. Top bit set means basic; the low seven bits give the rate in units of 500 kb/s. |
Carried in Assoc Request, Assoc Response, Beacon, Probe Request, Probe Response · cited to 802.11-2024 §9.4.2.3
One octet naming the channel the BSS is on.
Small and disproportionately useful. A capture tool records which channel it was listening on, but adjacent-channel energy means a frame can be heard off-channel — comparing this element against the capture channel is how you tell a real neighbour from bleed.
| shared | Identifies which element this is. Three here. | |
| shared | Always one for this element. | |
| Current Channel | 1 octet | The channel number the BSS is operating on. |
Carried in Beacon, Probe Response · cited to 802.11-2024 §9.4.2.4
Which dozing stations have traffic waiting, and when the next multicast delivery will be.
The reason power save works. A station wakes, reads one bit addressed to its association ID, and goes back to sleep if it is clear — so a device can sleep through almost every beacon interval and still never miss a frame.
| shared | Identifies which element this is. Five here. | |
| shared | ||
| DTIM Count | 1 octet | How many beacons remain until the next DTIM. |
| DTIM Period | 1 octet | How many beacon intervals lie between DTIMs. |
| Bitmap Control | 1 octet | A traffic indicator for group-addressed frames, plus an offset into the bitmap that follows. |
| Partial Virtual Bitmap | variable | One bit per association identifier, set when that station has traffic buffered. |
Carried in Beacon · cited to 802.11-2024 §9.4.2.5
Where the AP thinks it is, and what that permits. A country string, then a repeating triplet of first channel, channel count, and power limit.
A station that hears this may adopt the constraints in it, which makes this element the mechanism by which a device entering a country learns what it is allowed to transmit. It is advisory and unauthenticated — nothing stops an AP claiming to be somewhere it is not.
| shared | Identifies which element this is. Seven here. | |
| shared | ||
| Country String | 3 octets | Two characters of ISO country code, then one saying whether the limits that follow are for indoor use, outdoor use, or both. |
| Channel constraint | 3 octets | First channel number, how many channels follow it, and the maximum transmit power permitted across them. |
Carried in Probe Response · cited to 802.11-2024 §9.4.2.8
Twenty-six fixed octets describing an 802.11n radio: channel width, guard interval, aggregation limits, and which MCS values it can receive.
Fixed length, unlike most elements, because every field in it is a capability bitmap rather than a list. That makes it one of the few elements whose offsets can be trusted without reading its length.
| shared | Identifies which element this is. Forty-five here. | |
| shared | Always 26 for this element. | |
| HT Capabilities Information | 2 octets | Sixteen bits of radio capability. |
| A-MPDU Parameters | 1 octet | The largest aggregate this station can receive, and the spacing it needs between subframes. |
| Supported MCS Set | 16 octets | A bitmap of which of the 77 modulation and coding schemes this station can receive, plus its highest supported data rate. |
| HT Extended Capabilities | 2 octets | Support for transitioning between PCO channel widths, and for the MCS feedback the beamforming fields below rely on. |
| Transmit Beamforming Capabilities | 4 octets | Whether and how this station can participate in beamforming, as sounder or as responder. |
| ASEL Capabilities | 1 octet | Antenna selection support. |
Carried in Assoc Request, Assoc Response, Probe Request, Probe Response · cited to 802.11-2024 §9.4.2.55
Which ciphers protect this network and how a station proves it may join. A version, a group cipher, then counted lists of pairwise ciphers and authentication methods.
Sent in the clear, necessarily, because it is how two parties agree on the protection they have not yet established. Everything an attacker needs to know about which cipher suite is in use is readable before a single encrypted frame exists.
| shared | Identifies which element this is. Forty-eight here. | |
| shared | ||
| Version | 2 octets | Always 1. No version 2 has ever been defined. |
| Group Data Cipher Suite | 4 octets | The cipher protecting broadcast and multicast traffic: three octets of organisation identifier, then one selecting the suite. |
| Pairwise Cipher Suite Count | 2 octets | How many pairwise cipher suites follow. |
| Pairwise Cipher Suite List | 4 octets | The ciphers offered for unicast traffic, four octets each. |
| AKM Suite Count | 2 octets | How many authentication and key management suites follow. |
| AKM Suite List | 4 octets | How a station proves it may join and how the keys get derived. |
| RSN Capabilities | 2 octets | What this station or AP supports about management frame protection. |
Carried in Assoc Request, Probe Response · cited to 802.11-2024 §9.4.2.24
The rates that did not fit in Supported Rates. Same encoding, same meaning, different element ID.
A good example of what the element mechanism costs when it is used to work around a limit rather than to extend a protocol. A parser must read both elements and concatenate them, and an element carrying rates that duplicate the first one's is malformed in a way nothing enforces.
| shared | Identifies which element this is. Fifty here. | |
| shared | ||
| Rates | variable | One octet per rate, in half-megabit units, with the top bit marking a rate as part of the basic set. |
Carried in Assoc Request, Assoc Response, Probe Request, Probe Response · cited to 802.11-2024 §9.4.2.6