Wireless Control Frames + Client->AP communication

Here's just a little note at the start of this post about Client and AP communication because I don't want to create a separate post but can't really fit it anywhere else:
Client to AP communication:

1. Beacons are sent from the AP to make it's presence known
2. The client sends a probe request
3. The AP sends a probe response
4. The client sends authentication information
5. The client sends an association request
6. The AP sends an association response
7. Data is transferred
8. The AP or Client will disassociate and de-authenticate when they are done

Control Frames:

ACK - When DCF (Distributed Co-ordination Function) is in use, whereby everyone co-ordinates the media access, an ACK is sent in response by the AP to every frame without a CRC error. It is 13 bytes long and only contains a DA (Destination address); the client assumes it is from the AP which it sent the frame to. 

RTS - Request to Send are used when a host wants to send a frame to the AP. The RTS has a source address (SA) and DA, a duration (for the whole transmission including a SIFS, the CTS, another SIFS, the data frame, another SIFS and finally an ACK). 

CTS - Clear to Send only has a DA, the duration (for the remaining, including SIFS, data frame, SIFS and the ACK).

RTS and CTS are protection mechanisms used in the following scenarios:

1) When using 802.11b and 802.11g devices the g host sends a RTS and CTS at 802.11b speeds so the 802.11b hosts know a transmission is about to occur.

2) RTS/CTS is also used in a hidden network, if 2 hosts are so far away from each other that they cannot detect each other. Because the AP is centrally located it sends out a CTS to each AP in turn.

The 802.11 header has the field 'frame control', which contains a bit which can be used to denote if power saving mode is being used. The host sends an empty frame, called a null function, with the power saving bit turned on if it is alerting the AP that it is going into power saving mode. A clock is set to wake it up later. The AP buffers all frames for the host and keeps track of each sleeping host. The TIM (Traffic Indication Map) is used by the AP, sent to a host, if it is buffering packets. The Host receives the TIM, and replies so that the AP can send the buffered packets. Power saving mode is not often used because it doesn't save much battery life and adds a lot of overhead onto the network.