A SOC analyst asks why control frames (ACK/RTS/CTS class) differ in purpose from management frames. What is accurate?
Select an answer to reveal the explanation.
Short Explanation
Management frames run the membership desk—who’s here, what’s the network name. Control frames are the traffic cops waving ACK/RTS/CTS so the air doesn’t crash.
Full Explanation
Control frames such as ACK, RTS, and CTS coordinate medium access, reduce collisions, and acknowledge frame delivery at the 802.11 MAC. Management frames handle discovery and connection-state tasks—beacons, probes, authentication, and association—so recon and association analysis primarily study that class. SOC analysts assessing civic Wi-Fi should separate “who is coordinating the air” from “who is advertising or joining a BSS” when reading captures, because mistaking one class for the other leads to wrong filters and wasted investigation time. Saying control frames carry only captive-portal HTML and management frames carry only DHCP invents Layer-7 content roles those MAC frame types do not own. Reversing the classes so management frames acknowledge every data MSDU while control frames only advertise SSIDs scrambles the 802.11 taxonomy. Claiming the two classes are identical marketing renames erases useful analytical distinctions that matter during authorized assessments. Exam caveat: Handshake and beacon work is management-centric; airtime troubleshooting often inspects control and data interactions under authorization. Operational check: Filter an authorized capture to show beacons and association frames versus ACK/RTS/CTS and confirm the team can name each class’s purpose before escalating to cryptographic analysis.