Wi-Fi, HaLow & ESP-NOW Protocol Architecture
Wi-Fi encompasses far more than indoor gigabit routers. From raw 802.11 MAC management beacons to sub-1GHz 802.11ah HaLow and vendor-specific connectionless ESP-NOW frames, understanding packet framing reveals how wireless controllers communicate without touching IP routing.
01 · The 802.11 MAC Frame Architecture
Every 802.11 transmission, whether standard 2.4 GHz Wi-Fi or 915 MHz Wi-Fi HaLow, shares the same core Medium Access Control (MAC) framing structure. Unlike standard Ethernet (which only uses two 6-byte MAC addresses for Source and Destination), 802.11 frames include up to four addresses to handle wireless access point distribution:
| FC (2B) | Duration (2B) | Addr 1 (6B) | Addr 2 (6B) | Addr 3 (6B) | Seq Ctrl (2B) | Addr 4 (6B) | QoS (2B) | Payload (Var) | FCS (4B) |
|---|---|---|---|---|---|---|---|---|---|
| Type/Subtype | NAV Time (µs) | Receiver (RA) | Transmitter (TA) | BSSID / Filtering | Seq & Frag No | WDS Mesh Only | Priority TID | LLC / Data / IE | CRC-32 Check |
| Header Field | Wire Size | Functional Role & Engineering Detail |
|---|---|---|
| Frame Control (FC) | 2 Bytes | Protocol version, Type (Management/Control/Data), Subtype, To/From DS, Retry, Power Mgmt, Protected Frame, Order flags |
| Duration / ID | 2 Bytes | Microseconds the RF medium will remain busy for virtual carrier-sense (NAV reservation) or association ID |
| Address 1 (RA / DA) | 6 Bytes | Receiver Address (immediate RF listener) or Destination Address (final endpoint MAC) |
| Address 2 (TA / SA) | 6 Bytes | Transmitter Address (immediate RF sender) or Source Address (originating client MAC) |
| Address 3 (BSSID / DA) | 6 Bytes | Basic Service Set Identifier (AP radio MAC) for infrastructure filtering, or router gateway MAC |
| Sequence Control | 2 Bytes | Fragment Number (4 bits) and Sequence Number (12 bits) to detect and discard duplicate transmissions |
| Address 4 | 6 Bytes | Optional; only present in Wireless Distribution System (WDS) AP-to-AP mesh frames where both ToDS and FromDS are 1 |
| QoS Control / HT Control | 2–4 Bytes | Traffic Class (TID), ACK policies, and high-throughput modulation feedback for 802.11n/ac/ax |
| Frame Body (Payload) | 0–2304 Bytes | Upper-layer LLC/SNAP encapsulation, IP packets, or management Information Elements (IEs) |
| FCS (CRC-32) | 4 Bytes | Cyclic Redundancy Check calculated over all header and payload bytes. Invalid frames dropped in silicon |
Frame Control Bitfield Breakdown
The first 2 bytes of every 802.11 frame instruct all listening transceivers how to handle the packet. If the Frame Control type indicates a control frame (such as an RTS, CTS, or ACK), it does not carry an upper-layer payload.
- Type 00 (Management): Beacons, Probe Requests/Responses, Association Requests, Authentication frames. Used for network discovery and link negotiation.
- Type 01 (Control): RTS (Request to Send), CTS (Clear to Send), ACK (Acknowledgment), Block ACK. Tiny frames transmitted at low, robust data rates to arbitrate channel access.
- Type 10 (Data): Standard IP payloads, QoS Data, Null Function frames (used to notify AP of power-save sleep states).
- ToDS / FromDS Bits: Control which addresses represent the client, the AP BSSID, and the Ethernet gateway. When both bits are 0, communication is direct ad-hoc or peer-to-peer.
02 · Anatomy of a Wi-Fi Beacon Management Frame
Access Points emit Beacon Frames roughly 10 times per second (default interval: 100 Time Units = 102.4 ms). In passive RF engineering, beacons provide complete visibility into local spectrum occupancy without transmitting a single packet or alerting nearby systems.
| Element / Tag | Element Name | Length | RF Telemetry & Diagnostic Information Extracted |
|---|---|---|---|
| Fixed (0–11) | Timestamp & Interval | 12 Bytes | 64-bit microsecond counter for TSF sync + 16-bit beacon interval (default 100 TUs = 102.4 ms) + Capability flags |
| IE 0 (0x00) | SSID Parameter Set | 2–34 Bytes | Network name in UTF-8 text (or zero length if SSID broadcast is suppressed) |
| IE 1 (0x01) | Supported Rates | 3–10 Bytes | List of 802.11 legacy rates (e.g., 1, 2, 5.5, 11 Mbps) supported by the BSS; basic rates marked with MSB set |
| IE 3 (0x03) | DSSS / Current Channel | 3 Bytes | Direct channel indicator (1–14) broadcast by 2.4 GHz transmitters to verify operating frequency |
| IE 5 (0x05) | Traffic Indication Map (TIM) | 6–256 Bytes | Bitmap informing sleeping power-save client stations whether buffered unicast frames await retrieval |
| IE 48 (0x30) | RSN (Robust Security Network) | Var | WPA2/WPA3 authentication suites (AKM), pairwise/group ciphers (CCMP-128, GCMP-256), and PMF requirements |
| IE 45 / 61 | HT Capabilities & Info | Var | 802.11n spatial streams, 40 MHz channel operation, short guard interval (SGI), and greenfield support |
| IE 191 / 192 | VHT / HE Capabilities | Var | 802.11ac 80/160 MHz channels, 802.11ax OFDMA resource unit (RU) layouts, and BSS color integers |
Passive RF Site Auditing via Beacons
By logging only Beacon and Probe Response frames, diagnostic survey tools map co-channel interference (multiple APs on Channel 1 or 6), detect excessive non-standard channel widths (40 MHz in 2.4 GHz), and assess client density through the BSS Load Information Element (IE 11)—all completely passively with zero RF emissions.
03 · Wi-Fi HaLow (IEEE 802.11ah) Protocol Adaptations
Wi-Fi HaLow takes standard 802.11ac physical-layer OFDM and downclocks the baseband clock by exactly 10×. Instead of 20 MHz and 40 MHz microwave channels, HaLow operates with 1 MHz, 2 MHz, 4 MHz, and 8 MHz channels in the 902–928 MHz unlicensed ISM band.
1 MHz Narrowband Mode
Uses a dedicated Long Preamble structure with 32-carrier OFDM. Maximizes energy density per hertz, yielding up to 150 kbps to 4 Mbps at line-of-sight distances exceeding 1.5 to 3 kilometers.
2 MHz / 4 MHz Wideband Mode
Uses 64 or 128 OFDM subcarriers. Delivers multi-megabit throughput (up to 15+ Mbps) capable of supporting real-time RTSP/H.264 IP security video feeds over long distances.
Target Wake Time (TWT)
Stations negotiate precise wake intervals with the AP (minutes, hours, or days). The radio's RF synthesizer completely shuts down between bursts, allowing battery sensors to operate for years.
HaLow Modulation & Coding Schemes (MCS)
| MCS Index | Modulation | Coding Rate | 1 MHz Rate | 2 MHz Rate | Minimum SNR | Field Application |
|---|---|---|---|---|---|---|
| MCS 0 | BPSK | 1/2 | 300 kbps | 650 kbps | -1 dB | Longest link margin; used for remote sensors at property boundaries and fringe coverage |
| MCS 1 | QPSK | 1/2 | 600 kbps | 1,300 kbps | 2 dB | Standard telemetry baseline through walls and moderate vegetation |
| MCS 2 | QPSK | 3/4 | 900 kbps | 1,950 kbps | 5 dB | Stable audio streaming and multi-node sensor cluster hubs |
| MCS 3 | 16-QAM | 1/2 | 1,200 kbps | 2,600 kbps | 9 dB | Low-bitrate compressed H.264/H.265 security video feeds |
| MCS 4 | 16-QAM | 3/4 | 1,800 kbps | 3,900 kbps | 13 dB | 720p/1080p security camera feeds at mid-range distances |
| MCS 7 | 64-QAM | 5/6 | 4,000 kbps | 8,667 kbps | 22 dB | Full-rate video backhaul and rapid firmware OTA updates near base station |
04 · ESP-NOW Connectionless Action Frames
Developed by Espressif for ESP8266, ESP32, and ESP32-S/C series SoCs, ESP-NOW bypasses the entire Wi-Fi connection handshake (probe, auth, assoc, 4-way EAPOL key exchange, DHCP IP lease). Instead, devices exchange data instantly using raw 802.11 Vendor-Specific Action Frames:
| 802.11 MAC Hdr (24B) | Category (1B) | Espressif OUI (3B) | Random Token (4B) | Vendor Data (0–250B) | FCS (4B) |
|---|---|---|---|---|---|
| Type 00, Subtype 1101 (Action) | 127 (Vendor-Specific) | 0x18:0xFE:0x34 | Replay Protection | User Struct / Telemetry | Hardware CRC-32 |
Sub-5 Millisecond Latency
A sleeping node wakes from deep sleep, transmits a sensor payload to a known peer MAC, waits for an immediate 802.11 hardware ACK, and returns to sleep in under 15 milliseconds total runtime.
Zero Router Dependency
ESP-NOW operates peer-to-peer or one-to-many broadcast on a fixed 2.4 GHz channel (e.g. Channel 1, 6, or 11). If the home Wi-Fi access point loses power or reboots, field sensor communications continue uninterrupted.
Optional CCMP Encryption
Peers can share a 16-byte Primary Master Key (PMK) and Local Master Key (LMK) to encrypt payloads with AES-128 in CCMP mode directly in the radio hardware.
05 · Passive Promiscuous Mode Diagnostics
Modern Wi-Fi microcontrollers like the ESP32 include hardware support for Promiscuous Mode. In this mode, the radio MAC filter is disabled, allowing the firmware to capture and examine raw 802.11 frames circulating on the tuned RF channel.
void wifi_sniffer_cb(void *buf, wifi_promiscuous_pkt_type_t type) {
wifi_promiscuous_pkt_t *pkt = (wifi_promiscuous_pkt_t *)buf;
int8_t rssi = pkt->rx_ctrl.rssi; // Signal strength in dBm
uint16_t len = pkt->rx_ctrl.sig_len; // Physical frame length
uint8_t *mac_hdr = pkt->payload; // Raw 802.11 MAC bytes
}
Strictly Passive Diagnostic Purpose
Passive sniffing is used by wireless engineers to generate heatmaps, detect RF dead zones, quantify co-channel packet retransmissions, and audit beacon health. OpenRF Note strictly covers defensive diagnostics and monitoring; packet injection, deauthentication frames, or offensive intrusion workflows are outside our engineering scope.