Protected Frame

Set when the frame body has been encrypted.

Reading a capture

When set, the frame body does not begin with the payload — it begins with the cipher's own header. This bit is what tells you to expect a protection layer in the stack.

Where it sits

QoS Data MPDU > Frame Control > Protected Frame

• Open in the explorer — Ack
• Open in the explorer — TCP over IPv4, in a protected QoS Data frame, aggregated
• Open in the explorer — Association Request
• Open in the explorer — Association Response
• Open in the explorer — Beacon
• Open in the explorer — Compressed Block Ack
• Open in the explorer — CTS
• Open in the explorer — Four-way handshake message 1
• Open in the explorer — Four-way handshake message 2
• Open in the explorer — Four-way handshake message 3
• Open in the explorer — Four-way handshake message 4
• Open in the explorer — Probe Request
• Open in the explorer — Probe Response
• Open in the explorer — ARP request in a QoS Data frame
• Open in the explorer — ICMP echo over IPv4, in a QoS Data frame
• Open in the explorer — UDP over IPv6, in a QoS Data frame
• Open in the explorer — TCP over IPv4, in a protected QoS Data frame
• Open in the explorer — TCP over IPv4, in an open QoS Data frame
• Open in the explorer — UDP over IPv4, in a QoS Data frame
• Open in the explorer — RTS
• Open in the explorer — Trigger frame

Accuracy

Clause

802.11-2024 §9.2.4.1.9

Verified

Not verified against the standard. Treat this as a claim, not a fact.