Frame Formats

The format of the MAC frames is specified in this clause. All stations will be able to properly construct frames for transmission and decode frames upon reception, as specified in this clause.

MAC Frame Formats

Each frame consists of the following basic components:

• MAC header, which comprises frame control, duration, address, and sequence control information

• A variable-length frame body, which contains information specific to the frame type

• An FCS, which contains an IEEE 32-bit cyclic redundancy code (CRC)

Conventions  The MPDUs or frames in the MAC sublayer are described as a sequence of fields in specific order. Each of the following figures depicts the fields/subfields as they appear in the MAC frame and in the order in which they are passed to the Physical Layer Convergence Protocol (PLCP) from left to right. In figures, all bits within fields are numbered, from 0 to k, where the length of the field is k + 1 bit. The octet boundaries within a field can be obtained by taking the bit numbers of the field modulo 8. Octets within numeric fields that are longer than a single octet are depicted in increasing order of significance, from the lowest numbered bit to highest numbered bit. The octets in fields longer than a single octet are sent to the PLCP in order from the octet containing the lowest numbered bits to the octet containing the highest numbered bits. Any field containing a CRC is an exception to this convention and is transmitted commencing with the coefficient of the highest-order term.

MAC addresses are assigned as ordered sequences of bits. The Individual/Group bit is always transferred first and is bit 0 of the first octet. Values specified by a decimal are coded in natural binary unless otherwise stated. Reserved fields and subfields are set to 0 upon transmission and are ignored upon reception.

General Frame Format  The MAC frame format comprises a set of fields that occur in a fixed order in all frames. Figure 5-10 depicts the general MAC frame format. The fields Address 2, Address 3, Sequence Control, Address 4, and Frame Body are only present in certain frame types.

Figure 5-10: MAC frame format

Frame Fields

Frame Control Field  The Frame Control field consists of the following subfields: Protocol Version, Type, Subtype, To DS, From DS, More Fragments, Retry, Power Management, More Data, WEP, and Order. The format of the Frame Control field is illustrated in Figure 5-11.

Figure 5-11: Frame Control field

Duration/ID Field  The Duration/ID field is 16 bits in length. The contents of this field are as follows:

• In control-type frames of subtype PS-Poll, the Duration/ID field carries the AID of the station that transmitted the frame in the 14 least significant bits with the 2 most significant bits both set to 1. The value of the AID is in the range 1 to 2,007.

• In all other frames, the Duration/ID field contains a duration value as defined for each frame type. For frames transmitted during the CF period (CFP), the Duration field is set to 32,768. Whenever the contents of the Duration/ID field are less than 32,768, the duration value is used to update the network allocation vector (NAV).

The encoding of the Duration/ID field is described in Table 5-1.

Table 5-1. Duration/ID field encoding

Bit 15	Bit 14	Bit 13—0	Usage
0	0—32,767		Duration
1	0	0	Fixed value within frames transmitted during the CFP
1	0	1—16,383	Reserved
1	1	0	Reserved
1	1	1—2,007	AID in PS-Poll frames
1	1	2,008—16,383	Reserved

Address Fields  There are four address fields in the MAC frame format. These fields are used to indicate the basic service set identifier (BSSID), source address, destination address, transmitting station address, and receiving station address. The usage of the four address fields in each frame type is indicated by the abbreviations BSSID, DA, SA, RA, and TA, BSSID, Destination Address, Source Address, Receiver Address, and Transmitter Address, respectively. Certain frames may not contain some of the address fields. Certain address field usage is specified by the relative position of the address field (1—4) within the MAC header, independent of the type of address present in that field. For example, receiver address matching is always performed on the contents of the Address 1 field in received frames, and the receiver address of CTS and ACK frames is always obtained from the Address 2 field in the corresponding RTS frame or from the frame being acknowledged.

Address Representation  Each address field contains a 48-bit address, as defined in Clause 5.2 of IEEE 802-1990.

Address Designation  A MAC sublayer address is one of the following two types:

• Individual address  The address associated with a particular station on the network

• Group address  A multidestination address, associated with one or more stations on a given network

The two kinds of group addresses are as follows:

• Multicast-group address  An address associated by a higher-level convention with a group of logically related stations.

• Broadcast address  A distinguished, predefined multicast address that always denotes the set of all stations on a given LAN. All 1s in the Destination Address field are interpreted to be the broadcast address. This group is predefined for each communication medium to consist of all stations actively connected to that medium; it is used to broadcast to all the active stations on that medium. All stations are able to recognize the broadcast address. It is not necessary that a station be capable of generating the broadcast address.

The address space is also partitioned into locally administered and universal (globally administered) addresses. The nature of a body and the procedures by which it administers these universal (globally administered) addresses is beyond the scope of the 802.11 standard. See IEEE 802-1990 for more information.

BSSID Field  The BSSID field is a 48-bit field of the same format as an IEEE 802 MAC address. This field uniquely identifies each BSS. The value of this field, in an infrastructure BSS, is the MAC address currently in use by the STA in the AP of the BSS. The value of this field in an IBSS is a locally administered IEEE MAC address formed from a 46-bit random number generated according to the procedure defined in the standard. The individual/group bit of the address is set to 0. The universal/local bit of the address is set to 1. This mechanism is used to provide a high probability of selecting a unique BSSID. The value of all 1s is used to indicate the broadcast BSSID. A broadcast BSSID may only be used in the BSSID field of management frames of subtype probe request.

Destination Address (DA) Field  The DA field contains an IEEE MAC individual or group address that identifies the MAC entity or entities intended as the final recipient(s) of the MSDU (or fragment thereof) contained in the frame body field.

Source Address (SA) Field  The SA field contains an IEEE MAC individual address that identifies the MAC entity from which the transfer of the MSDU (or fragment thereof) contained in the frame body field was initiated. The individual/group bit is always transmitted as a zero in the source address.

Receiver Address (RA) Field  The RA field contains an IEEE MAC individual or group address that identifies the intended immediate recipient STA(s), on the WM, for the information contained in the frame body field.

Transmitter Address (TA) Field  The TA field contains an IEEE MAC individual address that identifies the STA that has transmitted, onto the WM, the MPDU contained in the frame body field. The Individual/Group bit is always transmitted as a zero in the transmitter address.

Sequence Control Field  The Sequence Control field is 16 bits in length and consists of two subfields: the Sequence Number and the Fragment Number. The format of the Sequence Control field is illustrated in Figure 5-12.

Figure 5-12: Sequence Control field

Sequence Number Field  The Sequence Number field is a 12-bit field indicating the sequence number of an MSDU or MAC management protocol data unit (MMPDU). Each MSDU or MMPDU transmitted by an STA is assigned a sequence number. Sequence numbers are assigned from a single modulo 4096 counter, starting at 0 and incrementing by 1 for each MSDU or MMPDU. Each fragment of an MSDU or MMPDU contains the assigned sequence number. The sequence number remains constant in all retransmissions of an MSDU, MMPDU, or fragment thereof.

Fragment Number Field  The Fragment Number field is a 4-bit field indicating the number of each fragment of an MSDU or MMPDU. The fragment number is set to zero in the first or only fragment of an MSDU or MMPDU and is incremented by one for each successive fragment of that MSDU or MMPDU. The fragment number remains constant in all retransmissions of the fragment.

Frame Body Field  The Frame Body is a variable-length field that contains information specific to individual frame types and subtypes. The minimum frame body is 0 octets. The maximum frame body is defined by the maximum length (MSDU + ICV + IV), where the integrity check value (ICV) and initialization vector (IV) are the WEP fields.

FCS Field  The FCS field is a 32-bit field containing a 32-bit CRC. The FCS is calculated over all the fields of the MAC header and the Frame Body field.

Format of Individual Frame Types

Control Frames  In the following descriptions, an immediately previous frame is a frame whose reception concluded within the prior short interframe space (SIFS) interval. The subfields within the Frame Control field of control frames are set, as illustrated in Figure 5-13.

Figure 5-13: Frame Control field subfield values within control frames

RTS Frame Format  The frame format for the RTS frame is defined in Figure 5-14.

Figure 5-14: RTS frame

The RA of the RTS frame is the address of the STA, on the WM, that is the intended immediate recipient of the pending directed data or management frame. The TA is the address of the STA transmitting the RTS frame.

The duration value is the time, in microseconds, required to transmit the pending data or management frame, plus one CTS frame, plus one ACK frame, plus three SIFS intervals. If the calculated duration includes a fractional microsecond, that value is rounded up to the next higher integer.

CTS Frame Format  The frame format for the CTS frame is defined in Figure 5-15. The RA of the CTS frame is copied from the TA field of the previous RTS frame to which the CTS is a response. The duration value is the value obtained from the Duration field of the immediately previous RTS frame, minus the time, in microseconds, required to transmit the CTS frame and its SIFS interval. If the calculated duration includes a fractional microsecond, that value is rounded up to the next higher integer.

Figure 5-15: CTS frame

Acknowledgment (ACK) Frame Format  The frame format for the ACK frame is defined in Figure 5-16. The RA of the ACK frame is copied from the Address 2 field of the immediately previous directed data, management, or PS-Poll control frame. If the More Fragment bit was set to 0 in the Frame Control field of the immediately previous directed data or management frame, the duration value is set to 0. If the More Fragment bit was set to 1 in the Frame Control field of the immediately previous directed data or management frame, the duration value is the value obtained from the Duration field of the immediately previous data or management frame, minus the time, in microseconds, required to transmit the ACK frame and its SIFS interval. If the calculated duration includes a fractional microsecond, that value is rounded up to the next higher integer.

Figure 5-16: ACK frame

Power-Save Poll (PS-Poll) Frame Format  The frame format for the PS-Poll frame is defined in Figure 5-17. The BSSID is the address of the STA contained in the AP. The TA is the address of the STA transmitting the frame. The AID is the value assigned to the STA transmitting the frame by the AP in the association response frame that established that STA’s current association. The AID value always has its two most significant bits set to 1. All STAs, upon receipt of a PS-Poll frame, update their NAV settings as appropriate under the coordination function rules using a duration value equal to the time, in microseconds, required to transmit one ACK frame plus one SIFS interval.

Figure 5-17: PS-Poll frame

CF-End Frame Format  The frame format for the CF-End frame is defined in Figure 5-18.

Figure 5-18: CF-End frame

The BSSID is the address of the STA contained in the AP. The RA is the broadcast group address. The Duration field is set to 0.

CF-End+CF-Ack Frame Format  The frame format for the CF-End acknowledge (CF-End+CF-Ack) frame is defined in Figure 5-19.

Figure 5-19: CF-End+CF-Ack frame

Data Frames  The frame format for a data frame is independent of subtype and is defined in Figure 5-20. The content of the address fields of the data frame is dependent upon the values of the “To DS” and “From DS” bits and is defined in Table 5-2. Where the content of a field is shown as not applicable (N/A), the field is omitted. Note that Address 1 always holds the receiver address of the intended receiver (or, in the case of multicast frames, receivers) and that Address 2 always holds the address of the station that is transmitting the frame.

Figure 5-20: Data frame

Table 5-2. Address field contents

To DS	From DS	Address 1	Address 2	Address 3	Address 4
0	0	DA	SA	BSSID	N/A
0	1	DA	BSSID	SA	N/A
1	0	BSSID	SA	DA	N/A
1	1	RA	TA	DA	SA

A station uses the contents of the Address 1 field to perform address matching for receive decisions. In cases where the Address 1 field contains a group address, the BSSID also is validated to ensure that the broadcast or multicast originated in the same BSS. A station uses the contents of the Address 2 field to direct the acknowledgment if an acknowledgment is necessary. The DA is the destination of the MSDU (or fragment thereof) in the frame body field. The SA is the address of the MAC entity that initiated the MSDU (or fragment thereof) in the frame body field. The RA is the address of the STA contained in the AP in the wireless distribution system

that is the next immediate intended recipient of the frame. The TA is the address of the STA contained in the AP in the wireless distribution system that is transmitting the frame. The BSSID of the data frame is determined as follows:

• If the station is an AP or is associated with an AP, the BSSID is the address currently in use by the STA contained in the AP.

• If the station is a member of an IBSS, the BSSID is the BSSID of the IBSS.

The frame body consists of the MSDU or a fragment thereof, and a WEP IV and ICV (if and only if the WEP subfield in the frame control field is set to 1). The frame body is null (0 octets in length) in data frames of Subtype Null function (no data), CF-Ack (no data), CF-Poll (no data), and CF-Ack+CF-Poll (no data). Within all data-type frames sent during the CFP, the Duration field is set to the value 32,768. Within all data-type frames sent during the contention period, the Duration field is set according to the following rules:

• If the Address 1 field contains a group address, the duration value is set to 0.

• If the More Fragments bit is set to 0 in the Frame Control field of a frame and the Address 1 field contains an individual address, the duration value is set to the time, in microseconds, required to transmit one ACK frame, plus one SIFS interval.

• If the More Fragments bit is set to 1 in the Frame Control field of a frame and the Address 1 field contains an individual address, the duration value is set to the time, in microseconds, required to transmit the next fragment of this data frame, plus two ACK frames, plus three SIFS intervals.

The duration value calculation for the data frame is based on rules that determine the data rate at which the control frames in the frame exchange sequence are transmitted. If the calculated duration includes a fractional microsecond, that value is rounded up to the next higher integer. All stations process Duration field values less than or equal to 32,767 from valid data frames to update their NAV settings as appropriate under the coordination function rules.

Management Frames  The frame format for a management frame is independent of frame subtype and is defined in Figure 5-21. An STA uses the contents of the Address 1 field to perform the address matching for receive decisions. In the case where the Address 1 field contains a group address and the frame type is other than Beacon, the BSSID also is validated to ensure that the broadcast or multicast originated in the same BSS.

Figure 5-21: Management frame

If the frame type is Beacon, other address-matching rules apply. The address fields for management frames do not vary by frame subtype. The BSSID of the management frame is determined as follows:

• If the station is an AP or is associated with an AP, the BSSID is the address currently in use by the STA contained in the AP.

• If the station is a member of an IBSS, the BSSID is the BSSID of the IBSS.

• In management frames of subtype Probe Request, the BSSID is either a specific BSSID or the broadcast BSSID.

The DA is the destination of the frame. The SA is the address of the station transmitting the frame.

Within all management type frames sent during the CFP, the Duration field is set to the value 32,768. Within all management type frames sent during the contention period, the Duration field is set according to the following rules:

• If the DA field contains a group address, the duration value is set to 0.

• If the More Fragments bit is set to 0 in the Frame Control field of a frame and the DA contains an individual address, the duration value is set to the time, in microseconds, required to transmit one ACK frame plus one SIFS interval.

• If the More Fragments bit is set to 1 in the Frame Control field of a frame and the DA contains an individual address, the duration value is the time, in microseconds, required to transmit the next fragment of this management frame, plus two ACK frames, plus three SIFS intervals.

The duration value calculation for the management frame is based on rules that determine the data rate at which the control frames in the frame exchange sequence are transmitted. If the calculated duration includes a fractional microsecond, that value is rounded up to the next higher integer. All stations process Duration field values less than or equal to 32,767 from valid management frames to update their NAV settings as appropriate under the coordination function rules. The frame body consists of the fixed fields and information elements defined for each management frame subtype. All fixed fields and information elements are mandatory unless stated otherwise, and they can appear only in the specified order. Stations encountering an element type they do not understand ignore that element. Element type codes not explicitly defined in the 802.11 standard are reserved and do not appear in any frames.

Beacon Frame Format  The frame body of a management frame of subtype Beacon contains the information shown in Table 5-3.

Table 5-3. Beacon frame body

Order	Information	Notes
1	Timestamp
2	Beacon interval
3	Capability information
4	SSID
5	Supported rates
6	FH Parameter Set	The FH Parameter Set information element is present within Beacon frames generated by STAs using frequency-hopping PHYs.
7	DS Parameter Set	The DS Parameter Set information element is present within Beacon frames generated by STAs using direct sequence PHYs.
8	CF Parameter Set	The CF Parameter Set information element is only present within Beacon frames generated by APs supporting a PCF.
9	IBSS Parameter Set	The IBSS Parameter Set information element is only present within Beacon frames generated by STAs in an IBSS.
10	TIM	The TIM information element is only present within Beacon frames generated by APs.

IBSS ATIM Frame Format  The frame body of a management frame of subtype ATIM is null.

Disassociation Frame Format  The frame body of a management frame of subtype Disassociation contains the information shown in Table 5-4.

Table 5-4. Disassociation frame body

Order	Information
1	Reason code

Association Request Frame Format  The frame body of a management frame of subtype Association Request contains the information shown in Table 5-5.

Table 5-5. Association Request frame body

Order	Information
1	Capability information
2	Listen interval
3	SSID
4	Supported rates

Association Response Frame Format  The frame body of a management frame of subtype Association Response contains the information shown in Table 5-6.

Table 5-6. Association Response frame body

Order	Information
1	Capability information
2	Status code
3	AID
4	Supported rates

Reassociation Request Frame Format  The frame body of a management frame of subtype Reassociation Request contains the information shown in Table 5-7.

Table 5-7. Reassociation Request frame body

Order	Information
1	Capability information
2	Listen interval
3	Current AP address
4	SSID
5	Supported rates

Reassociation Response Frame Format  The frame body of a management frame of subtype Reassociation Response contains the information shown in Table 5-8.

Table 5-8. Reassociation Response frame body

Order	Information
1	Capability information
2	Status code
3	AID
4	Supported rates

Probe Request Frame Format  The frame body of a management frame of subtype Probe Request contains the information shown in Table 5-9.

Table 5-9. Probe Request frame body

Order	Information
1	SSID
2	Supported rates

Probe Response Frame Format  The frame body of a management frame of subtype Probe Response contains the information shown in Table 5-10.

Table 5-10. Probe Response frame body

Order	Information	Notes
1	Timestamp
2	Beacon interval
3	Capability	information
4	SSID
5	Supported rates
6	FH Parameter Set	The FH Parameter Set information element is present within Probe Response frames generated by STAs using frequency-hopping PHYs.
7	DS Parameter Set	The DS Parameter Set information element is present within Probe Response frames generated by STAs using direct sequence PHYs.
8	CF Parameter Set	The CF Parameter Set information element is only present within Probe Response frames generated by APs supporting a PCF.
9	IBSS Parameter Set	The IBSS Parameter Set information element is only present within Probe Response frames generated by STAs in an IBSS.

Authentication Frame Format  The frame body of a management frame of subtype Authentication contains the information shown in Table 5-11.

Table 5-11. Authentication frame body

Order	Information	Notes
1	Authentication algorithm number
2	Authentication transaction sequence number
3	Status code	The status code information is reserved and set to 0 in certain Authentication frames, as defined in Table 5-12
4	Challenge text	The challenge text information is only present in certain Authentication frames, as defined in Table 5-12.

Table 5-12. Presence of challenge text information

Authentication Algorithm	Authentication Transaction Sequence Number	Status Code	Challenge Text
Open system	1	Reserved	Not present
Open system	2	Status	Not present
Shared key	1	Reserved	Not present
Shared key	2	Status	Present
Shared key	3	Reserved	Present
Shared key	4	Status	Not present

Deauthentication  The frame body of a management frame of subtype Deauthentication contains the information shown in Table 5-13.

Table 5-13. Deauthentication frame body

Order	Information
1	Reason code

Management Frame Body Components

Within management frames, fixed-length mandatory frame body components are defined as fixed fields; variable-length mandatory and all optional frame body components are defined as information elements.

Fixed Fields

Authentication Algorithm Number Field  The Authentication Algorithm Number field indicates a single authentication algorithm. The length of the Authentication Algorithm Number field is 2 octets. The Authentication Algorithm Number field is illustrated in Figure 5-22. The following values are defined for authentication algorithm number:

• Authentication algorithm number = 0: open system.

• Authentication algorithm number = 1: shared key.

• All other values of authentication number are reserved.

Figure 5-22. Authentication Algorithm Number fixed field

Authentication Transaction Sequence Number Field  The Authentication Transaction Sequence Number field indicates the current state of progress through a multistep transaction. The length of the Authentication Transaction Sequence Number field is 2 octets. The Authentication Transaction Sequence Number field is illustrated in Figure 5-23.

Figure 5-23. Authentication Transaction Sequence Number fixed field

Beacon Interval Field  The Beacon Interval field represents the number of time units (TUs) between target beacon transmission times (TBTTs). The length of the Beacon Interval field is 2 octets. The Beacon Interval field is illustrated in Figure 5-24.

Figure 5-24. Beacon Interval fixed field

Capability Information Field  The Capability Information field contains a number of subfields that are used to indicate requested or advertised capabilities. The length of the Capability Information field is 2 octets. The Capability Information field consists of the following subfields: ESS, IBSS, CF-Pollable, CF-Poll Request, and Privacy. The remaining part of the Capability Information field is reserved. The format of the Capability Information field is illustrated in Figure 5-25.

Figure 5-25: Capability Information field

Each Capability Information subfield is interpreted only in the management frame subtypes for which the transmission rules are defined. APs set the ESS subfield to 1 and the IBSS subfield to 0 within transmitted Beacon or Probe Response management frames. STAs within an IBSS set the ESS subfield to 0 and the IBSS subfield to 1 in transmitted Beacon or Probe Response management frames. STAs set the CF-Pollable and CF-Poll Request subfields in Association and Reassociation Request management frames according to Table 5-14.

Table 5-14. STA usage of CF-Pollable and CF-Poll Request

CF-Pollable	CF-Poll Request	Meaning
0	0	STA is not CF-Pollable.
0	1	STA is CF-Pollable, not requesting to be placed on the CF-Polling list.
1	0	STA is CF-Pollable, requesting to be placed on the CF-Polling list.
1	1	STA is CF-Pollable, requesting never to be polled.

APs set the CF-Pollable and CF-Poll Request subfields in Beacon, Probe Response, Association Response, and Reassociation Response management frames according to Table 5-15. An AP sets the CF-Pollable and CF-Poll Request subfield values in Association Response and Reassociation Response management frames equal to the values in the last Beacon or Probe Response frame that it transmitted.

Table 5-15. AP usage of CF-Pollable and CF-Poll Request

CF-Pollable	CF-Poll Request	Meaning
0	0	No PC at AP.
0	1	PC at AP for delivery only (no polling)
1	0	PC at AP for delivery and polling
1	1	Reserved

APs set the Privacy subfield to 1 within transmitted Beacon, Probe Response, Association Response, and Reassociation Response management frames if WEP encryption is required for all data-type frames exchanged within the BSS. If WEP encryption is not required, the Privacy subfield is set to 0.

STAs within an IBSS set the Privacy subfield to 1 in transmitted Beacon or Probe Response management frames if WEP encryption is required for all data-type frames exchanged within the IBSS. If WEP encryption is not required, the Privacy subfield is set to 0.

Current AP Address Field  The Current AP Address field is the MAC address of the AP with which the station is currently associated. The length of the Current AP Address field is 6 octets. The Current AP Address field is illustrated in Figure 5-26.

Figure 5-26: Current AP Address field

Listen Interval Field  The Listen Interval field is used to indicate to the AP how often an STA wakes to listen to Beacon management frames. The value of this parameter is the STA’s Listen Interval parameter of the MLME-Associate request primitive and is expressed in units of Beacon Interval. The length of the Listen Interval field is 2 octets. The Listen Interval field is illustrated in Figure 5-27. An AP may use the Listen Interval information in determining the lifetime of frames that it buffers for an STA.

Figure 5-27: Listen Interval fixed field

Reason Code Field  This Reason Code field is used to indicate the reason that an unsolicited notification management frame of type Disassociation or Deauthentication was generated. The length of the Reason Code field is 2 octets. The Reason Code field is illustrated in Figure 5-28.

Figure 5-28: Reason Code fixed field

AID Field  The AID field is a value assigned by an AP during association that represents the 16-bit ID of an STA. The length of the AID field is 2 octets. The AID field is illustrated in Figure 5-29. The value assigned as the AID is in the range 1 to 2,007 and is placed in the 14 least significant bits of the AID field, with the two most significant bits of the AID field each set to 1.

Figure 5-29: AID fixed field

Status Code Field  The Status Code field is used in a response management frame to indicate the success or failure of a requested operation. The length of the Status Code field is 2 octets. The Status Code field is illustrated in Figure 5-30.

Figure 5-30: Status Code fixed field

If an operation is successful, then the status code is set to 0. If an operation results in failure, the status code indicates a failure cause.

Timestamp Field  This field represents the value of the TSFTIMER of a frame’s source. The length of the Timestamp field is 8 octets. The Timestamp field is illustrated in Figure 5-31.

Figure 5-31: Timestamp fixed field

Information Elements  Elements are defined to have a common general format consisting of a 1-octet Element ID field, a 1-octet length field, and a variable-length element-specific information field. Each element is assigned a unique Element ID, as defined in the 802.11 standard. The Length field specifies the number of octets in the Information field (see Figure 5-32). The set of valid elements is defined in Table 5-16.

Figure 5-32: Element format

Table 5-16. Element IDs

Information Element	Element ID
SSID	0
Supported rates	1
FH Parameter Set	2
DS Parameter Set	3
CF Parameter Set	4
TIM	5
IBSS Parameter Set	6
Reserved	7—15
Challenge text	16
Reserved for challenge text extension	17—31
Reserved	32—255