Group Data Cipher Suite Group

MAC 4 octets RSN element unverified

The cipher protecting broadcast and multicast traffic: three octets of organisation identifier, then one selecting the suite.

Reading a capture

One cipher, not a list, because every station in the BSS must decrypt the same group traffic. That makes it the floor — a BSS whose group cipher is TKIP is a TKIP network no matter what the pairwise list says.

Values

Value Meaning
2 TKIP
4 CCMP-128
8 GCMP-128
9 GCMP-256

Bit values written b0 first, matching transmission order.

Where it sits

RSN > Group Data Cipher Suite

Accuracy

Clause
802.11-2024 §9.4.2.24
Byte order
little-endian — least significant octet first
Verified
Not verified against the standard. Treat this as a claim, not a fact.