diff --git a/Packets/80211Bundle/WLANPacket.cc b/Packets/80211Bundle/WLANPacket.cc
index 675a09bff6c4f8dd1ebad0161a8a662daa2e1379..c704f6d2e4b32372c2791fc12e4d1d813f912346 100644
--- a/Packets/80211Bundle/WLANPacket.cc
+++ b/Packets/80211Bundle/WLANPacket.cc
@@ -81,6 +81,26 @@ prefix_ senf::MACAddressParser senf::WLANPacket_DataFrameParser::bssid()
     return addr1();
 }
 
+prefix_ senf::PacketInterpreterBase::factory_t senf::WLANPacketType::nextPacketType(packet p)
+{
+    if (p->is_dataFrame() && (p->subtype()==0 || p->subtype()==8)) //data frame and subtype is Data or QoS Data
+        return LlcSnapPacket::factory();
+    return no_factory();
+}
+
+prefix_ senf::PacketInterpreterBase::optional_range senf::WLANPacketType::nextPacketRange(packet p)
+{
+    if (p->is_dataFrame()) {
+        size_type sz = 24; //header length of wlan data frame (WDS is not considered)
+        if (p->subtype()==8) //subtype QoSData
+            sz+=2;  //2 bytes for QoS field
+        return range(
+                boost::next(p.data().begin(),sz),
+                boost::prior(p.data().end(),4) ); //-4 bytes FCS
+    }
+    //TODO beacon frame payload
+    return no_range();
+}
 
 prefix_ void senf::WLANPacketType::dump(packet p, std::ostream &os)
 {
diff --git a/Packets/80211Bundle/WLANPacket.hh b/Packets/80211Bundle/WLANPacket.hh
index 046bed9d1a0f943c3f9e3f0e03bfa2ef5cd904c1..b91df6b79e9ac81a4ba8fa123c421d2f74db3e4c 100644
--- a/Packets/80211Bundle/WLANPacket.hh
+++ b/Packets/80211Bundle/WLANPacket.hh
@@ -39,7 +39,7 @@ namespace senf
     struct WLANPacket_MgtFrameParser : public senf::PacketParserBase
     {
     #   include SENF_FIXED_PARSER()
-        
+
         SENF_PARSER_PRIVATE_BITFIELD ( subtype, 4,  unsigned                ); //<pkgdraw: hide
 	//skip type and version
         SENF_PARSER_SKIP_BITS        (          4                           ); //<pkgdraw: hide
@@ -73,7 +73,7 @@ namespace senf
     struct WLANPacket_CtrlFrameParser : public senf::PacketParserBase
     {
     #   include SENF_PARSER()
-        
+
         SENF_PARSER_PRIVATE_BITFIELD ( subtype,  4,  unsigned            ); //<pkgdraw: hide
 	//skip type and version
         SENF_PARSER_SKIP_BITS        (           4                       ); //<pkgdraw: hide
@@ -220,10 +220,12 @@ namespace senf
         typedef senf::ConcretePacket<WLANPacketType> packet;
         typedef WLANPacketParser parser;
 
-//        using mixin::nextPacketRange;
+
         using mixin::init;
         using mixin::initSize;
-        using senf::PacketTypeBase::nextPacketRange;;
+//        using senf::PacketTypeBase::nextPacketRange;
+        static optional_range nextPacketRange(packet p);
+        static factory_t nextPacketType(packet p);
 
         static void dump(packet p, std::ostream &os);
 //        static PacketParserBase::size_type initSize();
diff --git a/Packets/80211Bundle/WLANPacket.test.cc b/Packets/80211Bundle/WLANPacket.test.cc
index f1f943706b625c5acc39403740b1b5620ed57ef6..5f1060356722349b8f458da40306d62993a907ae 100644
--- a/Packets/80211Bundle/WLANPacket.test.cc
+++ b/Packets/80211Bundle/WLANPacket.test.cc
@@ -26,6 +26,7 @@
 // Custom includes
 #include "WLANPacket.hh"
 #include "../../Packets/Packets.hh"
+#include "../DefaultBundle/LlcSnapPacket.hh"
 
 #include "../../Utils/auto_unit_test.hh"
 #include <boost/test/test_tools.hpp>
@@ -39,10 +40,11 @@ BOOST_AUTO_UNIT_TEST(WLANPacket_dataFrame_packet)
             0x4d, 0x3e, 0xc7, 0x5c, 0x00, 0x0b, 0x6b, 0x57,
             0x06, 0xb0, 0x00, 0x18, 0x4d, 0x6e, 0x78, 0x48,
             0x30, 0x00, 0x01, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //dummy data
+            0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x08, 0x00,  //llc header
             0x38, 0x39, 0x30, 0x31                          //trailer
     };
 
+
     senf::WLANPacket p (senf::WLANPacket::create(data));
 
     BOOST_CHECK_EQUAL( p->version(),        0u    );
@@ -81,6 +83,9 @@ BOOST_AUTO_UNIT_TEST(WLANPacket_dataFrame_packet)
 
     std::ostringstream oss (std::ostringstream::out);
     SENF_CHECK_NO_THROW( p.dump( oss));
+
+    BOOST_CHECK( p.next());
+    BOOST_CHECK( p.next().is<senf::LlcSnapPacket>() );
 }