Bit Field Guide

UDP over IPv4, in a QoS Data frame

Connectionless transport. Eight octets of header where TCP spends twenty — which is most of why real-time traffic chooses it, and why the saving shows up as airtime on a wireless link.

Find a frame
PHY
Class
Mechanism

Everything here is true proportion on each lane's own axis. Labels float above their field and step down a row only where they would collide, so nothing is inflated to make its name fit. Zoom widens the whole diagram together and scrolls sideways, which keeps the lanes aligned.

PHY 802.11b µs
MAC octets

this whole lane is the PSDU above it

Not in this frame: Address 4 — Both To DS and From DS are 1. An absent field takes no octets at all; what follows moves up to meet what came before.

LLC octets

this whole lane is the Frame Body above it

NET octets

this whole lane is the Payload above it

TSPT octets

this whole lane is the Payload above it

The Data slot is open — nothing is stacked below this lane yet. A truncated stack is a valid composition, not a broken one.

How the layers combine

Each layer names the unit it receives from above differently from the unit the layer above hands down. They are the same octets. Nothing is added crossing a seam — the header you see appear was always inside the slot, and only becomes visible when the next layer subdivides it.

  1. PPDU = SYNC + SFD + Header + PSDU
    the PSDU is the MPDU — same octets, different name
  2. MPDU = FC + Dur + A1/RA + A2/TA + A3 + SeqCtl + QoS + Body + FCS
    the MSDU is the LPDU — same octets, different name byte order flips to network order ; bit 0 moves to the other end of the octet
  3. LPDU = DSAP + SSAP + Control + OUI + EtherType + Payload
    the Payload is the Datagram — same octets, different name
  4. Datagram = Version + IHL + DSCP + ECN + Total Length + Identification + Flags + Fragment Offset + TTL + Protocol + Header Checksum + Src + Dst + Payload
    the Payload is the Datagram — same octets, different name
  5. Datagram = SrcPort + DstPort + Length + Checksum + Data

Select any field to read what it is and why it matters.

The octets

Structure is a property of the format; values are a property of the capture. Everything above is named and positioned whether or not you hold the passphrase — only the octets below are withheld.

The octets

82 octets, exactly as a capture tool would show them — most significant bit leftmost, which is the opposite direction from the bit strips above. Click a field to highlight its octets, or an octet to find its field.

0000··,···^·S···^·S·
0010··^·S·@·········
0020··E··,·F@·@·2)··
0030···3d··P·5····he
0040llo, bit field··
0050·I

A shaded octet is shared by more than one field — several sub-octet fields live inside it, so highlighting the byte overstates any one of them.

Every field, and what contains what

The same frame as a hierarchy rather than a scale drawing. Proportion is useful for airtime and useless for structure — a one-bit flag and a 1500-octet payload matter equally here and not at all equally above.

Structure

Every field in this transmission and what contains what — one hierarchy from the PPDU on the air down to the application's bytes. Indentation is containment. 65 fields, 65 unverified.