Null Data Packet Announcement
The Null Data Packet Announcement (NDPA) is a Wi-Fi management frame transmitted by an access point (AP) to announce that it is about to send a Null Data Packet (NDP) for channel sounding purposes. The NDPA identifies which client stations will participate in the sounding sequence and in what order, effectively acting as a "heads up" broadcast before the AP performs channel estimation. Because NDPAs are transmitted in the clear — unencrypted — they are visible to any passive observer within radio range, making them a significant vector for wireless surveillance and device fingerprinting.
Definition
The NDPA is classified as a VHT (Very High Throughput) or HE (High Efficiency) management frame, depending on whether it is used under the IEEE 802.11ac or 802.11ax standard. Its core function is to coordinate the sounding dialogue between an AP and one or more client stations (STAs) so that the AP can gather Channel State Information (CSI) and subsequently apply beamforming to direct radio energy more precisely toward each client.
Unlike data frames, NDPAs carry no user payload. Their entire purpose is procedural: they alert participating stations that a Null Data Packet — a specially structured frame carrying training sequences but no data — is about to be transmitted on the current channel. Each station listed in the NDPA knows to listen for the NDP and prepare a compressed beamforming feedback report in response.
The NDPA is defined formally in:
- IEEE 802.11ac-2013 — introduced for VHT beamforming
- IEEE 802.11ax-2021 (Wi-Fi 6) — extended for multi-user (MU) sounding and the Beamforming Report Poll (BFRP) trigger frame mechanism
Frame Structure and Content
The NDPA frame contains several key fields:
Sounding Dialogue Token
A sequence number assigned by the AP that ties the NDPA to the NDP that follows it. Each sounding sequence uses a unique token so that stations can correctly match an incoming NDP to the announcement that preceded it. This token also appears in subsequent Beamforming Feedback Information (BFI) reports, closing the loop on the sounding exchange.
Station Information Fields
The NDPA contains one STA Info field per client being sounded. Each STA Info field includes:
- The Association ID (AID) of the target station — a 12-bit identifier assigned when the device joined the network
- Feedback Type — whether the station should return SU (single-user) or MU (multi-user) beamforming matrices
- Nc Index — the number of spatial stream columns expected in the feedback Compressed Beamforming Matrix
- Nr Index — the number of receive antennas the AP is using for sounding
- BW — the bandwidth (20, 40, 80, or 160 MHz) of the sounding exchange
- Grouping — subcarrier grouping parameter that affects the granularity of the Channel State Information returned
Antenna and Bandwidth Configuration
The frame encodes antenna count and bandwidth parameters that govern the resolution of channel measurement. Higher bandwidth sounding yields more detailed CSI, allowing the AP to construct more accurate beamforming matrices — and incidentally providing a richer dataset for any passive observer capturing the subsequent NDP.
Role in the Sounding Sequence
The NDPA is the first frame in a four-stage sounding exchange:
- NDPA — broadcast by the AP; identifies target stations and sounding parameters
- Null Data Packet (NDP) — transmitted immediately after (within the SIFS interval, typically 16 µs); carries pilot training sequences across all spatial streams
- BFRP Trigger Frame (802.11ax only, optional in MU scenarios) — polls each station in turn to return its feedback report
- BFI Report — each sounded station returns a compressed matrix describing how the channel shaped the NDP as it arrived
.svg)
This tight, timed sequence means that any system monitoring for NDPA frames can predict — with millisecond precision — when the subsequent NDP will appear. This synchronisation capability is foundational to passive sensing attacks (see below).
In standard Wi-Fi operation, the full sequence completes in under one millisecond. The AP then uses the returned Channel State Information to pre-code its transmit signal via a steering matrix, directing energy toward intended clients and away from interference.
Unencrypted Transmission
Like all Wi-Fi management frames, NDPAs are transmitted without encryption. This is by design: the NDPA must be readable by stations that have not yet performed a cryptographic handshake in the current sounding context, and by stations that may need to defer their own transmissions during the sounding window.
The practical consequence is that any device with a Wi-Fi adapter placed in monitor mode — requiring no special hardware, only commodity equipment and open-source software such as Wireshark or tcpdump — can capture every NDPA frame broadcast within radio range. From a captured NDPA, a passive observer can immediately read:
- The MAC Address of the transmitting access point
- The Association IDs (AIDs) of every client station being sounded
- The exact timing of upcoming NDP transmission
- The antenna and bandwidth configuration of the sounding exchange
- The sounding token, enabling correlation with subsequent BFI reports
No decryption is required. The frame is fully legible in plaintext.
Surveillance Significance
The unencrypted, broadcast nature of NDPAs creates several surveillance-relevant capabilities:
Device Relationship Mapping
By logging NDPA frames over time, an observer can build a detailed map of which devices are associated with which access points. Each AID listed in an NDPA corresponds to a specific client; combined with MAC Address tracking (even with MAC randomisation, AIDs leak persistent associations), an attacker can chart the social and device relationships within a network — identifying which phones, laptops, and IoT devices belong to the same household or organisation.
This is directly relevant to the study of Surveillance Technology and corporate or state-level network intelligence gathering.
NDP Capture Synchronisation
Because the NDPA announces the NDP with microsecond precision, a passive observer who captures the NDPA can synchronise their receiver to capture the NDP itself. The NDP carries wideband pilot signals across all transmit antennas; by measuring how those pilot signals are distorted during propagation, the observer can compute their own version of the Channel State Information — effectively performing Channel Estimation from outside the network, without any cooperation from either the AP or the clients.
This is the foundation of passive Wi-Fi Sensing and Through-Wall Surveillance research.
Occupancy and Behaviour Inference
The frequency and pattern of NDPA transmissions change in response to environmental conditions. When people move within a space, they alter multipath propagation; the AP's beamforming system adapts by sounding more frequently or by observing degraded CSI coherence. An external observer monitoring NDPA frame rates — without ever decrypting a data frame — can therefore infer:
- Whether a space is occupied or empty
- Approximate number of moving bodies
- Gross movement patterns and routines
- Times of arrival and departure from a monitored location
Some researchers in the Wi-Fi Sensing literature have demonstrated that NDPA-triggered NDP capture, combined with machine learning applied to extracted CSI, can identify individuals by gait, detect breathing and heartbeat, and even infer emotional states — all from unencrypted management frame timing and the radio channel data they expose.
.jpg)
Association with Passive Radar
When NDPA and NDP capture are combined, the resulting CSI dataset is functionally equivalent to what a purpose-built channel sounder or indoor passive radar system would collect. The AP becomes, in effect, an unwitting radar transmitter; the passive observer's receiver performs the measurement. This is sometimes described in the academic literature as "opportunistic radar" or "device-free localisation."
Connection to Through-Wall Surveillance is direct: walls attenuate but do not block Wi-Fi signals, and CSI extracted from NDP frames captured outside a building carries geometric information about reflectors inside it. Combined with tomographic or deep-learning reconstruction algorithms, this enables sensing of occupants without any sensor ever entering the space.
Standards References
The NDPA frame is formally defined in the following standards documents:
- IEEE 802.11ac-2013 — Section 8.3.1.14 (VHT NDPA frame format); Section 9.26 (VHT sounding protocol)
- IEEE 802.11ax-2021 — Extended NDPA format for HE sounding; multi-user (MU) sounding sequence with BFRP trigger
Both standards are published by the IEEE Standards Association. The FCC mandates that commercial Wi-Fi equipment comply with the relevant 802.11 physical layer specifications, but neither body imposes any encryption requirement on management frames, leaving NDPAs permanently readable.
