This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How come I don’t see Acks for my Auth/Assoc frames?

0

Aren't all unicast frames supposed to be Ack'd? I never see Acks for Authentication and Association frames. Am I missing something?

asked 07 May '15, 16:21

elin05's gravatar image

elin05
21226
accept rate: 0%


One Answer:

2

To answer your question: Aren't all unicast frames supposed to be Ack'd?

Yes, assuming a DCF/EDCA channel access method is being implemented in your WLAN. Nearly all WLAN’s utilize DCF and/or EDCA methods. Assuming we have a DCF, then “all individually addressed traffic uses immediate positive acknowledgment (ACK frame) where retransmission is scheduled by the sender if no ACK is received.” Reference IEEE-2012 specification, section 9.3.1. Also, the station does not send an ACK frame in response to an Action NoAck frame. Saying all that, please refer to this link for an expected WiFi association exchange: https://drive.google.com/file/d/0B80gG9wZvGF0ZU5Wd2xSTnluQ0U/view?usp=sharing

To answer your main question: How come I don't see Acks for my Auth/Assoc frames?

This could be a result of many different factors:

  1. Noisy or busy RF environment = your adapter cannot capture all the traffic that exists on the channel
  2. Driver is dumping certain frames before delivering to host
  3. A capture filter is removing ACK frames = not likely if you are seeing ACK frames for Data

From experience, a majority of my captures do not show ACK frames for the Authentication and Association frames. The capture provided in the link was performed in a RF shielded room with no other 2.4GHz interfering devices present. It also was done with a known working adapter/driver combination.

answered 08 May '15, 11:31

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%

Why do all the frames in your capture show 0x0 FCS? (They were all flagged by my color filter wlan.fcs_bad==1)

(08 May '15, 12:13) elin05

That is definitely my WiFi adapter driver stripping the FCS and replacing it with zeros. On another WiFi adapter driver, I see the correct FCS. But some of the ACK's are missing.

(08 May '15, 12:20) Amato_C

"But some of the ACK's are missing." Why are your ACKs missing? Could it be for the same reason as mine?

(08 May '15, 14:28) elin05

In my case, the only difference is the WiFi adapter and driver.

(08 May '15, 18:08) Amato_C