Open the sandbox and take an 802.11 MAC frame apart — decode its Frame Control word into a type and subtype, add up its field lengths, check that its FCS trailer is a genuine CRC-32, and read the MCS PHY rate. Predict each number before the readout confirms it.
An 802.11 MAC frame is a fixed sequence of fields: Frame Control (2) | Duration/ID (2) | Address 1/2/3 (6 each) | Sequence Control (2) | [Address 4 (6)] | Frame Body | FCS (4). The offsets are contiguous, so the field lengths sum to the total: a 24-byte header (30 with Address 4), the body, and a 4-byte trailer. That trailer, the FCS, is a CRC-32 with the reflected polynomial 0xEDB88320 (IEEE 802.3) — the same one whose canonical check value over "123456789" is 0xCBF43926, which is how you know a CRC-32 is real. The MCS index only names a modulation and coding rate; the PHY data rate is computed from the physical parameters, not looked up.
Open the sandbox. It opens on a default Beacon frame (Frame Control 0x0080, a 64-byte body, MCS 5), so a Reset gets you back to Step 1. Each step names the one knob to move; leave the rest where they are.
Frame Control (hex) -> 0x0080 Frame body length -> 64 bytes MCS index -> set per step (5, then 7)
Include Address 4 -> off Short guard interval -> off Flip one byte -> off Reset -> 0x0080, 64 bytes, MCS 5
Watch the Frame type and Total length readout cards, the FCS — CRC-32 reference panel, and the MCS index → PHY data rate panel — every number you predict is printed there.
Leave the default Frame Control 0x0080. The subtype is bits 4–7 of the 16-bit word: 0x0080 = 0000 0000 1000 0000, so bits 4–7 read 1000. Predict the subtype number, then read the Frame type card and the Frame Control, bit by bit panel.
The subtype is 8, and with type 0 (Management) that is a Beacon — the frame an access point broadcasts to announce itself. Bits 1000 = 8.
Keep the 64-byte body and Address 4 off. The offsets are contiguous, so the total is header + body + FCS = 24 + 64 + 4. Predict the total frame length in bytes, then read the Total length card.
The card reads 92 bytes — 24 + 64 + 4. Turn on Address 4 and the header grows to 30, so the total jumps by exactly 6 to 98.
The FCS trailer is a CRC-32 with the reflected polynomial 0xEDB88320. Any correct CRC-32 gives one fixed value over the ASCII string "123456789" — its canonical check value. Predict what the demo's CRC-32 gives for that string, then read the Standard check value row of the FCS — CRC-32 reference panel.
The value is 0xCBF43926 — that is 3421780262 in decimal, the canonical CRC-32 check value. The demo reproduces it exactly, so its FCS is the genuine IEEE 802.3 CRC-32, not a stand-in. Flip one byte and the recomputed CRC no longer matches the trailer — the frame reads CORRUPT.
Drag the MCS index from 5 up to 7, leaving the short guard interval off and a single stream. The rate is N_SD · N_BPSCS · R · N_SS / T_SYM with N_SD = 52 and T_SYM = 4.0 µs. Predict the PHY data rate, then read the MCS index → PHY data rate panel.
The panel reads 65 Mb/s — 64-QAM at coding rate 5/6 over 52 subcarriers in a 4.0 µs symbol. Turn on the short guard interval and it rises about 11% to 72.22 Mb/s (4.0 / 3.6).
Everything above is waiting in the sandbox. Type a new Frame Control hex and watch the 16 bits and the flags change, stretch the body and see every offset after it shift, toggle Address 4 for the +6 bytes, flip a byte to break the FCS, and slide the MCS index to watch the PHY rate climb.
- Decoded Frame Control 0x0080 to subtype 8 — a Management / Beacon frame
- Summed the field lengths to 92 bytes — 24 + 64 + 4, and saw Address 4 add 6
- Confirmed the FCS is a real CRC-32: its check value over "123456789" is 0xCBF43926 = 3421780262
- Computed the MCS 7 PHY rate as 65 Mb/s — 64-QAM, rate 5/6, one stream, long GI
- Every value you predicted is the demo's own exact arithmetic, not a picture