Let's start by talking about the Wi-Fi frames:
- PPDU (PLCP Packet Data Unit) : This is the frame at the physical layer (Layer 1 of the OSI Model).
- MPDU (Mac Protocol Data Unit) : This is the frame at the Data-Link layer (Layer 2 of the OSI Model).
The MPDU is encapsulated into the PPDU as shown in the drawing below (taken from the CWAP study guide):
- non-HT Legacy: used with non 802.11n clients
- HT Mixed: used for both 802.11n and non 802.11n clients
- HT Greenfield: used and understood only by 802.11n clients
However, Wireshark is still able to tell you if the frame is sent with 802.11n. Here is where to find it:
- Filter data frames using the following filter: "wlan.fc.type==2"
- Click on the frame you want to check
- Open the "Radiotap Header" tab in the packet detail view
- Type of modulation (OFDM in our case)
- Frequency Band (5GHz in our case)
- Channel width (40MHz in our case)
However, some data frames, like the "Null function" frames, are not sent with 40MHz width channels even if the network is configured that way. Therefore, Wireshark does not see these frames as 802.11n frames. Instead (because of the OFDM modulation and the use of the 5GHz band), Wireshark tags these frames as being 802.11a frames:
Written by François Vergès
Source: CWAP Study Guide by CWNP