title: 802.11 QoS data frames
body: <p>I'm trying to parse 802.11 frames myself and I've encountered two problems that I can't solve.</p>
  
  <p>First of all, when does an LLC (Logical Link Control) header follow a IEEE 802.11 data frame ? I thought when there is data in a frame, there would always be an llc overhead preceding the data, but I have a wireshark with Ethernet II instead of LLC. But I have no idea how to actually know if it's gonna be an LLC or a Ethernet II header following my 802.11 data header. There's no field in the 802.11 header specifyin what's following. </p>
  
  <p>Secondly, I have noticed something in wireshark when I open a capture file containing 802.11 QoS data frames. At the end of the header there's the QoS control field, which is normal, it's specified in the IEEE 802.11 documentation (i've read it over and over again to try to find an answer to my question) But then, there's 2 bytes that wireshark considers part of the 802.11 header (when you click on the raw bytes, wireshark points to the 802.11 header, but the signification of the bytes is not displayed in the fields of the header ! Does my question make any sense ?</p>
  
  <p>Here are images to explain what I'm not understanding. On the first screen shot below, you see the 802.11 header selected and you see below the concerned bytes in hexadecimal.
  <img src="https://i.stack.imgur.com/tQa04.png" alt="Entire 802.11 header"></p>
  
  <p>Pay attention to the last bytes of this packet:00 00 10 aa </p>
  
  <p>Now I expand the 802.11 header and click on the very last field of it (QoS control, as specified in the RFC). You can see that the corresponding bytes are 00 00. But those bytes are not the last bytes of the packet ! There still is 10 aa that's part of the wifi packet but I have no idea what those bytes represent !</p>
  
  <p><img src="https://i.stack.imgur.com/cuj85.png" alt="last field selected"></p>
  
  <p>Any one has an idea ?</p>