Find out and AID from Partial Virtual Bitmap

Important fields

Bitmap Control (1 byte): First bit in this field indicates multicast/broadcast frames are buffered at the AP & other 7 bits are used as space save (bitmap offset).
Partial Virtual Bitmap(1-251 byte): Series of flags indicating whether each associated Station has unicast frames buffered at the AP. Each bit in this filed corresponds to an AID of an associated station.

In bitmap control field, first bit set to 1 that indicate buffered traffic at AP is broadcast or multicast. Remaining 7 bits used as Bitmap Offset, which may have any value between 0 to 127 used as a space saver. For an example, if there is no buffered traffic to AID 1-70 then all those values are 0 in Partial Virtual Bitmap section. To save some space, you can use Bitmap offset value to indicate how many bytes are Zero in Partial Virtual Bitmap (PVB).
 Let’s say Bitmap Offset is N, then 2xN bytes are zero in PVB. In example mentioned below N=4 where 8 bytes (or 64 bits) can be zero & those 64 bits can be skipped by setting Bitmap Offset value to 4.

Example 1:

Reference trace

https://www.cloudshark.org/captures/169a75f46227

Two packets - a beacon with TIM IE, and a PS Poll frame.

For this example, this is what I have for the TIM map:

     Length 15

     Offset 4

     pvm     20 00 00 00 00 00 00 00 10 00 20 00 (12 bytes)

     Bytes:  [12] 8...19

(Here there are total 12 bytes in the PVM. As Bitmap offset value is 4 i.e 4*2=8 Byte(64 bits) are all zeroes so start is 8th Byte and end is 19th Byte)

     Bits:   64...159

     AID 64=> 0x20= 0(65 bit)0(66)1(67)0(68) 0(69)0(70)0(71)0(72)

     AID 72=> 0x00=

     AID 80=> 0x00

     AID 88=> 0x00

     AID 96=> 0>x00

     AID 104=>0x00

     AID 112=>0x00

     AID 120=>0x00

     AID 128=>0x10 0(129)0(130)0(131)1(132) 0000

     AID 136=>0x00

     AID 144=>0x20

     AID 152=>0x00

AID 64-73    -> 00000100
AID 72-79    -> 00000000
AID 80-87    -> 00000000
AID 88-95    -> 00000000
AID 96-103  -> 00000000
AID 104-111-> 00000000
AID 112-119-> 00000000
AID 120-127-> 00000000
AID 128-135-> 00001000 <--- device 132, per AID in PS-Poll
AID 136-143-> 00000000
AID 144-151-> 00000100
AID 152-159-> 00000000

In the above beacon frame AP has buffered unicast frames for AID 67 and 132. So that STA with AID 132.

[NOTE: Ignore PS-POLL frame in the reference capture]

Example 2:
Reference trace in Beacon frame:

        Tag: Traffic Indication Map (TIM): DTIM 128 of 207 bitmap

            Tag Number: Traffic Indication Map (TIM) (5)

            Tag length: 4

            DTIM count: 128

            DTIM period: 200

            Bitmap control: 0xcf

                .... ...1 = Multicast: True

                1100 111. = Bitmap Offset: 0x67

            Partial Virtual Bitmap: 9d

            Association ID: 1648

            Association ID: 1650

            Association ID: 1651

            Association ID: 1652

            Association ID: 1655

Bitmap offset= 0x67

In this case N=0x67 = in decimal its 103. 

2xN = 2x103= 206 Bytes= 1648 bits

PVB = 0x9d = 1001 1101

1001 1101 ....[bits 1647-0]

1(1655) 0(1654) 0(1653) 1(1652) 1(1651) 1(1650) 0(1649) 1(1648) ---(1647)[0-1647]