Four-way handshake message 2

The station answers with its own nonce and the first MIC on the link, proving it derived the same key without either side sending it.

Find a frame
PHY
Class
Mechanism

Everything here is true proportion on each lane's own axis. Labels float above their field and step down a row only where they would collide, so nothing is inflated to make its name fit. Zoom widens the whole diagram together and scrolls sideways, which keeps the lanes aligned.

PHY 802.11a µs
MAC octets

this whole lane is the PSDU, inside the DATA field above

Not in this frame: Address 4 — Both To DS and From DS are 1. An absent field takes no octets at all; what follows moves up to meet what came before.

LLC octets

this whole lane is the Frame Body above it

SEC octets

this whole lane is the Payload above it

SEC octets

this whole lane is the Packet Body above it

How the layers combine

Each layer names the unit it receives from above differently from the unit the layer above hands down. They are the same octets. Nothing is added crossing a seam — the header you see appear was always inside the slot, and only becomes visible when the next layer subdivides it.

  1. PPDU = L-STF + L-LTF + L-SIG + DATA ⊃ PSDU
    the PSDU is the MPDU — same octets, different name
  2. MPDU = FC + Dur + A1/RA + A2/TA + A3 + SeqCtl + QoS + Body + FCS
    the MSDU is the LPDU — same octets, different name byte order flips to network order ; bit 0 moves to the other end of the octet
  3. LPDU = DSAP + SSAP + Control + OUI + EtherType + Payload
    the Payload is the EAPOL PDU — same octets, different name
  4. EAPOL PDU = Ver + Type + Len + Packet Body
    the Packet Body is wrapped by EAPOL-Key descriptor — a header and trailer around the same payload bit 0 moves to the other end of the octet
  5. Key = Desc + Key Info + Key Length + Replay + Nonce + IV + RSC + Reserved + MIC + Data Len + Data

Select any field to read what it is and why it matters.

The octets

Structure is a property of the format; values are a property of the capture. Everything above is named and positioned whether or not you hold the passphrase — only the octets below are withheld.

The octets

159 octets, exactly as a capture tool would show them — most significant bit leftmost, which is the opposite direction from the bit strips above. Click a field to highlight its octets, or an octet to find its field.

0000··,···^·S···^·S·
0010··^·S·`·········
0020·····u··········
0030···PQRSTUVWXYZ[\
0040]^_`abcdefghijkl
0050mno·············
0060················
0070·····u+·]·······
0080B1···0··········
0090············r·!

A shaded octet is shared by more than one field — several sub-octet fields live inside it, so highlighting the byte overstates any one of them.

Every field, and what contains what

The same frame as a hierarchy rather than a scale drawing. Proportion is useful for airtime and useless for structure — a one-bit flag and a 1500-octet payload matter equally here and not at all equally above.

Structure

Every field in this transmission and what contains what — one hierarchy from the PPDU on the air down to the application's bytes. Indentation is containment. 80 fields, 80 unverified.