MAC addresses, to DS, from DS in a wireless frame

An Access Point acts as a portal between wireless connection and wired connection.
It translates a wireless frame with data payload to a wired frame with data payload. As the technology works in Layer 1 and 2, everything which is above in OSI model is considered as a data payload and is encrypted when encryption is enabled.

In wired networking in a wired frame there are only 2 x MAC addresses: source address and destination address.

In wireless networking in a wireless frame there are 5 x MAC addresses: source address (SA), destination address (DA), transmitter address (TA), receiver address (RA) and basic service set identifier (BSSID):

  • SA is a MAC address of the original sender (wired or wireless)
  • DA is a MAC address of the final destination (wired or wireless)
  • TA is a MAC address of the transmitting 802.11 radio
  • RA is a MAC address of the receiving 802.11 radio
  • BSSID is a Layer 2 identifier of the BSS

Example: beacon frame.

1

In most of the occasions 3 x addresses will be used, however in point-to-point links or mesh networks we will see 4 x addresses.

In a 802.11 Frame Control field, there are 2 important fields, which indicates in which direction the connection goes: to DS and from DS fields. There are 4 possibilities:

  1. To DS = 0 and From DS = 0
  2. To DS = 1 and From DS = 0
  3. To DS = 0 and From DS = 1
  4. To DS = 1 and From DS = 1

I will present in more details what MAC addresses are used in each of the scenario based on the setup from my lab.

 

1.  To DS = 0 and From DS = 0

As an example, simple beacon frame, which is originated from the AP radio MAC address (BSSID, transmitter and source addresses) to all mobile clients (receiver and destination addresses). Management and control frames are dedicated to wireless networking only and that’s why we have toDS=0 and fromDS=0. 

3 addresses are being used:
Address 1 – RA=DA, ff:ff:ff:ff:ff:ff – broadcast to all mobile clients
Address 2 – TA=SA, 84:24:8d:c1:24:20 – AP BSSID
Address 3 – BSSID,  84:24:8d:c1:24:20 – AP BSSID

Scenarios:
a. Management frames:

6


b. Control frames:

3.PNG

c. IBSS, ad-hoc network:

11

12

 

2. To DS = 1 and From DS = 0

A wireless data frame is being sent from a mobile client to wired network.
Example: ICMP echo request ping test from the mobile client (source and transmitter address) via the AP (receiver address and BSSID) to the default gateway, which is the wireless controller (destination address).

3 addresses are being used:
Address 1 – RA=BSSID, 84:24:8d:c1:24:20 – AP BSSID 
Address 2 – TA=SA, cc:44:63:1b:2d:fa – mobile client’s MAC address 
Address 3 – DA,  74:8e:f8:4f:02:76 – DG – WLC port’s MAC address

5

 

3. To DS = 0 and From DS = 1

A wireless data frame is being sent from the wired network to the mobile client associated to the AP.
Example: ICMP echo response ping test from the default gateway, which is the wireless controller (source address) via the AP (transmitter address and BSSID) to the mobile client (receiver and destination address).

3 addresses are being used:
Address 1 – RA=DA, cc:44:63:1b:2d:fa – mobile client’s MAC address
Address 2 – TA=BSSID, 84:24:8d:c1:24:20 – AP BSSID
Address 3 – SA,  74:8e:f8:4f:02:76 – DG – WLC port’s MAC address

7

4. To DS = 1 and From DS = 1

Typical mesh environment. The mobile client is associated to 2.4 GHz radio of the Aruba IAP Mesh Point.
Here it is an ICMP echo response as a data payload, which was sent from the default gateway, which is the wireless controller (source address) from the Aruba IAP Mesh Portal (transmitter address) on 5GHz radio to the Aruba IAP Mesh Point (receiver address) on 5GHz radio as a point-to-point bridge to the final destination, which is the mobile client (destination address). Eventually the Aruba IAP Mesh Point will process the frame and send it to the mobile client using 2.4 GHz radio, where the client is associated.

4 addresses are being used:
Address 1 – RA, f0:5c:19:65:64:30 – Aruba IAP Mesh Point – BSSID
Address 2 – TA, f0:5c:19:65:60:f1 – Aruba IAP Mesh Portal – BSSID
Address 3 – DA, cc:44:63:1b:2d:fa – mobile client’s MAC address
Address 4 – SA, 74:8e:f8:4f:02:76 – DG – WLC port’s MAC address

9

Summary:

Knowing and understanding what roles of the MAC addresses are in the wireless frames is very important for the wireless network engineer. This is fundamental element for troubleshooting and analysis of wireless frames. 

10.png

Reference:
CWAP Official Study Guide: Exam PW0-270 – Chapter 3 & Chapter 6
My lab

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s