Wi-Fi Frame Decoder
Paste an 802.11 frame from Wireshark or any hex dump and see every field decoded: header, elements, security, handshakes and action frames. Each field shows an explanation of what it is, with its IEEE 802.11 clause.
How to use this tool controls and what to look for
Paste the hex bytes of a frame, or choose a sample frame, and every field is decoded with an explanation.
Controls to change
- Choose a sample frame…: try a beacon, probe request, EAPOL-Key, encrypted data frame, deauthentication or Block Ack.
- Frame bytes: paste a frame copied from Wireshark (Copy → as Hex Stream) or any hex dump.
- Radiotap header: leave it on Auto, or say whether the bytes start with a radiotap header.
- FCS at the end: say whether the last 4 bytes are the frame check sequence, so it can be checked.
What to look for
- The To DS and From DS bits decide what each of the address fields means.
- In a beacon, the RSN element shows the security on offer, and the HT, VHT, HE and EHT elements show what the AP supports.
- In EAPOL-Key frames, follow the ANonce, SNonce and MIC through the 4-way handshake.
- In the radiotap header, check the signal strength and data rate the frame was received with.
About this tool
Paste the bytes of an 802.11 frame, from a Wireshark hex dump or any hex stream, and this decoder shows every field: the radiotap header added by the capture, the MAC header, the fixed fields and elements of management frames, action frames such as BSS Transition Management, control frames such as Block Ack and Trigger, and data frames with their LLC/SNAP header, EAPOL-Key handshake messages or CCMP header. Hover over any field or byte for an explanation of what it is; each field shows its IEEE 802.11 clause. Decoding happens in your browser, and nothing you paste is sent anywhere.
What you'll learn
- How an 802.11 frame is built: the MAC header, the frame body and the FCS, and what the To DS and From DS bits do to the addresses
- What a beacon's elements advertise: SSID, rates, security (RSN), HT, VHT, HE and EHT capabilities, and Reduced Neighbor Reports for 6 GHz
- How to read the 4-way handshake in EAPOL-Key frames, and what the CCMP packet number is for
- How to check an FCS, and what a radiotap header tells you about how a frame was received
Common questions
How do I copy a Wi-Fi frame from Wireshark?
Capture in monitor mode so you see real 802.11 frames, select a frame, right-click the bytes pane and choose Copy, then as Hex Dump or as a Hex Stream. Paste it into the decoder; a radiotap header in front and an FCS at the end are found automatically.
What does the RSN element in a beacon tell me?
The network's security: the group and pairwise ciphers (usually CCMP-128), the AKM suites clients can use (for example SAE for WPA3-Personal or 802.1X for Enterprise) and capability flags such as whether protected management frames are required.
Can the decoder decrypt encrypted frames?
No. For encrypted data and protected management frames it shows the CCMP or GCMP header, the key ID and the packet number, but the body can only be read with the session key.
Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.