This may be a dumb question but its Monday so they are allowed
I understand the reason for some packets/frames to have a duration of zero but is there a magic cut off line for data packets?
Looking at packet captures I see cards and APs from different vendors often setting a duration 0 even if its a data frame. Now I notice that the larger frames seem to always have a duration set and smaller ones do not.
Is there a magic size cutoff that a duration is not needed?
Thanks again for your time
I don't know about a magic length cutoff, but remember there are two length fields (effectively) in every packet. The [i]length[/i] specified in the PLCP header, and the [i]duration[/i] field in the MAC Header.
The duration covers what [u]follows[/u] the current packet.
Think of an ACK. Obviously it has a length of its own, and usually nothing follows it. Hence its MAC heder duration is Zero.
Any unicast data frame should have a duration value greater than zero. A typical (emphasizing typical) unicast data frame will have a duration value equal to a SIFS + ACK.
My guess is that the frame you are looking at is a broadcast or multicast in which case the duration value would be zero.
As an aside, the reason for a duration value is to protect what comes after the frame with the duration value.
You may also see the Duration = 0 behavior if Block Acks are used. In that case, no Ack is expected after each individual data frame, thus there are no frames in the exchange that immediately follow the data frame.
Thanks guys I was being dumb they indeed were broadcasts and multicast type packets. It was Monday so I was allowed right :)