Management frames always have a standard 24-byte-long MAC header with three addresses, followed by a body of variable size
Management frames are sourced and dealt with at the MAC layer and never forwarded to the upper layers.
Management frames do not carry any upper-layer information. There is no MSDU encapsulated in the MMPDU frame body,
which carries only layer 2 information fields and information elements.
Information fields are fixed-length mandatory fields in the body of a management frame.
Information elements are variable in length and are optional.
Management frames are always limited to the cell space; they are never relayed through an access point to the DS, from the DS,
or from a station to another station. For this reason, management frames sent by access points always have the To DS and From DS
fields set to 0.
Management Frames are used by STAs to join and leave a BSS
aka Management MAC Protocol Data Unit (MMPDU)
When 802.11n is in use, the header is extended to show the HT Control section.
Management frames are of type 00, and the many different subtypes:
- Association Request (Subtype 0000 )
- Association Response (Subtype 0001 )
- Reassociation Request (Subtype 0010 )
- Reassociation Response (Subtype 0011 )
- Probe Request (Subtype 0100 )
- Probe Response (Subtype 0101 )
- Beacon (Subtype 1000 )
- Announcement Traffic Indication Message (ATIM) (Subtype 1001 )
- Disassociation (Subtype 1010 )
- Authentication (Subtype 1011 )
- Deauthentication (Subtype 1100 )
- Action (Subtype 1101 )
- Action no ack (Subtype 1110 )
All of the above subtypes will be discussed in the following posts.