Geckopico: Create: Null Data Packet Announcement

2026-09-23T03:56:14Z

Create: Null Data Packet Announcement

New page

The '''Null Data Packet Announcement''' ('''NDPA''') is a [[Wi-Fi Sensing|Wi-Fi]] management frame transmitted by an access point (AP) to announce that it is about to send a [[Null Data Packet]] (NDP) for [[Channel Sounding|channel sounding]] purposes. The NDPA identifies which client stations will participate in the sounding sequence and in what order, effectively acting as a "heads up" broadcast before the AP performs [[Channel Estimation|channel estimation]]. Because NDPAs are transmitted in the clear — unencrypted — they are visible to any passive observer within radio range, making them a significant vector for wireless surveillance and device fingerprinting.

[[File:Wi-Fi and Wi-Fi Diect.png|thumb|right|Wi-Fi access point and client network diagram]]

== Definition ==

The NDPA is classified as a '''VHT''' (Very High Throughput) or '''HE''' (High Efficiency) management frame, depending on whether it is used under the [[IEEE 802.11]]ac or 802.11ax standard. Its core function is to coordinate the sounding dialogue between an AP and one or more client stations (STAs) so that the AP can gather [[Channel State Information]] (CSI) and subsequently apply [[Beamforming Feedback Information|beamforming]] to direct radio energy more precisely toward each client.

Unlike data frames, NDPAs carry no user payload. Their entire purpose is procedural: they alert participating stations that a [[Null Data Packet]] — a specially structured frame carrying training sequences but no data — is about to be transmitted on the current channel. Each station listed in the NDPA knows to listen for the NDP and prepare a [[Compressed Beamforming Matrix|compressed beamforming feedback report]] in response.

The NDPA is defined formally in:
* '''IEEE 802.11ac-2013''' — introduced for VHT beamforming
* '''IEEE 802.11ax-2021''' (Wi-Fi 6) — extended for multi-user (MU) sounding and the Beamforming Report Poll (BFRP) trigger frame mechanism

== Frame Structure and Content ==

The NDPA frame contains several key fields:

=== Sounding Dialogue Token ===
A sequence number assigned by the AP that ties the NDPA to the NDP that follows it. Each sounding sequence uses a unique token so that stations can correctly match an incoming NDP to the announcement that preceded it. This token also appears in subsequent [[Beamforming Feedback Information]] (BFI) reports, closing the loop on the sounding exchange.

=== Station Information Fields ===
The NDPA contains one '''STA Info field''' per client being sounded. Each STA Info field includes:
* The '''Association ID''' (AID) of the target station — a 12-bit identifier assigned when the device joined the network
* '''Feedback Type''' — whether the station should return SU (single-user) or MU (multi-user) beamforming matrices
* '''Nc Index''' — the number of spatial stream columns expected in the feedback [[Compressed Beamforming Matrix]]
* '''Nr Index''' — the number of receive antennas the AP is using for sounding
* '''BW''' — the bandwidth (20, 40, 80, or 160 MHz) of the sounding exchange
* '''Grouping''' — subcarrier grouping parameter that affects the granularity of the [[Channel State Information]] returned

=== Antenna and Bandwidth Configuration ===
The frame encodes antenna count and bandwidth parameters that govern the resolution of channel measurement. Higher bandwidth sounding yields more detailed CSI, allowing the AP to construct more accurate [[Compressed Beamforming Matrix|beamforming matrices]] — and incidentally providing a richer dataset for any passive observer capturing the subsequent NDP.

== Role in the Sounding Sequence ==

The NDPA is the '''first frame''' in a four-stage sounding exchange:

# '''NDPA''' — broadcast by the AP; identifies target stations and sounding parameters
# '''[[Null Data Packet]]''' (NDP) — transmitted immediately after (within the SIFS interval, typically 16 µs); carries pilot training sequences across all spatial streams
# '''BFRP Trigger Frame''' (802.11ax only, optional in MU scenarios) — polls each station in turn to return its feedback report
# '''[[Beamforming Feedback Information|BFI Report]]''' — each sounded station returns a compressed matrix describing how the channel shaped the NDP as it arrived

[[File:2.4 GHz Wi-Fi channels (802.11b,g WLAN).svg|thumb|right|802.11 wireless frame structure]]

This tight, timed sequence means that any system monitoring for NDPA frames can predict — with millisecond precision — when the subsequent NDP will appear. This synchronisation capability is foundational to passive sensing attacks (see below).

In standard Wi-Fi operation, the full sequence completes in under one millisecond. The AP then uses the returned [[Channel State Information]] to pre-code its transmit signal via a steering matrix, directing energy toward intended clients and away from interference.

== Unencrypted Transmission ==

Like all Wi-Fi management frames, NDPAs are transmitted '''without encryption'''. This is by design: the NDPA must be readable by stations that have not yet performed a cryptographic handshake in the current sounding context, and by stations that may need to defer their own transmissions during the sounding window.

The practical consequence is that any device with a Wi-Fi adapter placed in '''monitor mode''' — requiring no special hardware, only commodity equipment and open-source software such as Wireshark or tcpdump — can capture every NDPA frame broadcast within radio range. From a captured NDPA, a passive observer can immediately read:

* The [[MAC Address]] of the transmitting access point
* The Association IDs (AIDs) of every client station being sounded
* The exact timing of upcoming NDP transmission
* The antenna and bandwidth configuration of the sounding exchange
* The sounding token, enabling correlation with subsequent BFI reports

No decryption is required. The frame is fully legible in plaintext.

== Surveillance Significance ==

The unencrypted, broadcast nature of NDPAs creates several surveillance-relevant capabilities:

=== Device Relationship Mapping ===
By logging NDPA frames over time, an observer can build a detailed map of which devices are associated with which access points. Each AID listed in an NDPA corresponds to a specific client; combined with [[MAC Address]] tracking (even with MAC randomisation, AIDs leak persistent associations), an attacker can chart the social and device relationships within a network — identifying which phones, laptops, and IoT devices belong to the same household or organisation.

This is directly relevant to the study of [[Surveillance Technology]] and corporate or state-level network intelligence gathering.

=== NDP Capture Synchronisation ===
Because the NDPA announces the NDP with microsecond precision, a passive observer who captures the NDPA can '''synchronise their receiver''' to capture the NDP itself. The NDP carries wideband pilot signals across all transmit antennas; by measuring how those pilot signals are distorted during propagation, the observer can compute their own version of the [[Channel State Information]] — effectively performing [[Channel Estimation]] from outside the network, without any cooperation from either the AP or the clients.

This is the foundation of passive [[Wi-Fi Sensing]] and [[Through-Wall Surveillance]] research.

=== Occupancy and Behaviour Inference ===
The '''frequency and pattern of NDPA transmissions''' change in response to environmental conditions. When people move within a space, they alter multipath propagation; the AP's beamforming system adapts by sounding more frequently or by observing degraded CSI coherence. An external observer monitoring NDPA frame rates — without ever decrypting a data frame — can therefore infer:

* Whether a space is occupied or empty
* Approximate number of moving bodies
* Gross movement patterns and routines
* Times of arrival and departure from a monitored location

Some researchers in the [[Wi-Fi Sensing]] literature have demonstrated that NDPA-triggered NDP capture, combined with machine learning applied to extracted CSI, can identify individuals by gait, detect breathing and heartbeat, and even infer emotional states — all from unencrypted management frame timing and the radio channel data they expose.

[[File:Indoor location services on mobile phone (10928087126).jpg|thumb|right|Passive radar indoor sensing]]

=== Association with Passive Radar ===
When NDPA and NDP capture are combined, the resulting CSI dataset is functionally equivalent to what a purpose-built [[Channel Sounding|channel sounder]] or indoor passive radar system would collect. The AP becomes, in effect, an unwitting radar transmitter; the passive observer's receiver performs the measurement. This is sometimes described in the academic literature as "opportunistic radar" or "device-free localisation."

Connection to [[Through-Wall Surveillance]] is direct: walls attenuate but do not block Wi-Fi signals, and CSI extracted from NDP frames captured outside a building carries geometric information about reflectors inside it. Combined with tomographic or deep-learning reconstruction algorithms, this enables sensing of occupants without any sensor ever entering the space.

== Standards References ==

The NDPA frame is formally defined in the following standards documents:

* '''IEEE 802.11ac-2013''' — Section 8.3.1.14 (VHT NDPA frame format); Section 9.26 (VHT sounding protocol)
* '''IEEE 802.11ax-2021''' — Extended NDPA format for HE sounding; multi-user (MU) sounding sequence with BFRP trigger

Both standards are published by the [[IEEE]] Standards Association. The [[FCC]] mandates that commercial Wi-Fi equipment comply with the relevant 802.11 physical layer specifications, but neither body imposes any encryption requirement on management frames, leaving NDPAs permanently readable.

== Related Pages ==

* [[Null Data Packet]]
* [[Channel Sounding]]
* [[Channel State Information]]
* [[Beamforming Feedback Information]]
* [[Compressed Beamforming Matrix]]
* [[Channel Estimation]]
* [[Through-Wall Surveillance]]
* [[Wi-Fi Sensing]]
* [[IEEE 802.11]]
* [[MAC Address]]
* [[Surveillance Technology]]
* [[5G]]
* [[6G]]
* [[6LoWPAN]]
* [[MEMS]]
* [[Internet of Bodies]]

[[Category:Surveillance Technology]]
[[Category:Technology]]

Null Data Packet Announcement - Revision history

Geckopico: Create: Null Data Packet Announcement