The same chain, encrypted. Locked, this is what a sniffer without the passphrase actually gets — a fully readable MAC header and an opaque body. Unlocked, it reads all the way down to the application data.
No frames match. Every filter above is a set of things to include —
an empty set includes nothing. Turn some back on, or
.
Zoomed into — this layer at full
width, its components opened. Other layers are collapsed for context.
Everything here is true proportion on each lane's own
axis. Labels float above their field and step down a row only where they
would collide, so nothing is inflated to make its name fit. Zoom widens the
whole diagram together and scrolls sideways, which keeps the lanes aligned.
magnified — at true scale this sits 36.1%
into the lane and is only 2.78% of it wide
CWRb0ECEb1URGb2ACKb3PSHb4RSTb5SYNb6FINb7
The Data slot is open — nothing is stacked below this
lane yet. A truncated stack is a valid composition, not a broken
one.
Showing through . Deeper layers are
hidden, not absent — the octets are still in the frame, and the fields
below still exist. LLC and SNAP stay visible at L2
because IEEE 802.2 LLC is the upper sublayer of the data link layer, not
something above it.
How the layers combine
Each layer names the unit it receives from above differently from the unit
the layer above hands down. They are the same octets. Nothing is added
crossing a seam — the header you see appear was always inside the slot, and
only becomes visible when the next layer subdivides it.
Select any field to read what it is and why it matters.
The octets
Structure is a property of the format; values are a property of the
capture. Everything above is named and positioned whether or not you hold
the passphrase — only the octets below are withheld.
🔒
Encrypted — values withheld
64 octets at offset 34 are
CCMP-128 ciphertext. Every field below is still
named, sized and positioned — that is the format, not the capture.
Only the values are unavailable, which is exactly what a sniffer
without the passphrase gets.
The passphrase reveals octets this site already holds. It does not derive a key or run AES — deriving one for real needs a four-way handshake, which needs management frames to exist first.
That passphrase does not match this network.
The octets
110 octets, exactly as a capture tool would show them —
most significant bit leftmost, which is the opposite direction from the
bit strips above. Click a field to highlight its octets, or an octet to
find its field.
0000
·A,···^·S···^·S·
0010
··^·S·@········
0020
········g··q0···
0030
··F···}···Gi····
0040
··e···~····PY·p;
0050
·CXdw·\·····-··
0060
ygk··8·····X··
The shaded span is ciphertext — 64 octets
from offset 34. Its structure is known and rendered
above; only these values are unavailable.
The shaded span is the 64 octets that
were ciphertext, now shown in the clear. Same offsets, same fields —
the lock never changed the structure, only what you could read.
A shaded octet is shared by more than one field — several sub-octet
fields live inside it, so highlighting the byte overstates any one of them.
Every field, and what contains what
The same frame as a hierarchy rather than a scale drawing. Proportion is
useful for airtime and useless for structure — a one-bit flag and a
1500-octet payload matter equally here and not at all equally above.
Structure
Every field in this transmission and what contains what — one hierarchy
from the PPDU on the air down to the application's bytes. Indentation is
containment. 118 fields, 118 unverified.