CWAP – MAC Header : Addresses

Tags

802.11 MAC Header, BSSID, CWAP, From DS bit, To DS bit

802.11 MAC sublayer address is one of the following two types

1. Individual Address (known as unicast address)
2. Group Address (Multicast or Broadcast address)

802.11 frame can have upto 4 address fields in the MAC header. 802.11 frames typically use only 3 of the MAC address fields, but frames send within WDS (Wireless Distribution System) requires all 4 MAC address fields. Content of those address fields could includes following.

1. Receiver Address (RA)
2. Transmitter Address (TA)
3. Basic Service Set Identifier (BSSID)
4. Destination Address (DA)
5. Source Address (SA)

Depending on how the “To DS” & “From DS” fields are used, the definition of each address fields of 4 MAC address fields will change. This will summarize in below diagram (CWAP Study Guide – Page 92)

Let’s take a look at each scenario with details to understand this better. I have used a 3850 (WLC) connected AP (3702-2) & use iPhone5 as client.

You can get client & BSSID information using CLI as shown below.

3850-1#show wireless client summary 
Number of Local Clients : 1
MAC Address    AP Name                          WLAN State              Protocol 
--------------------------------------------------------------------------------  
04f7.e4ea.5b66 3702-2                           21   UP                 11n(5) 

3850-1#show wireless client mac-address 04f7.e4ea.5b66 detail | in MAC|BSSID
Client MAC Address : 04f7.e4ea.5b66
AP MAC Address : b838.6199.1aa0 <- Radio1 Base AP MAC address
BSSID : b838.6199.1aaf

To DS=0 , From DS=0
One of the scenario for “To DS”=0 & “From DS”=0 is either control frame or management frame. Since those frame does not go to DS, both bits set to 0. In this case addressing values should be like this.

Address 1: RA=DA (Receiver Address= Destination Address)
Address 2: TA=SA (Transmitter Address= Source Address)
Address 3: BSSID

Here is a Association Request frame coming from Client station to AP. As you can see below addressing fields content in captured wireless frame.

Address 1= RA/DA-b8:38:61:99:1a:af (AP Radio MAC for given SSID)
Address 2= TA/SA-04:f7:e4:ea:5b:66 (iPhone5 802.11 MAC)
Address 3= b8:38:61:99:1a:af (BSSID)

To DS=0, From DS=1
This may be a frame coming from wired system to wireless client. I have generate an ICMP ping from wired PC (192.168.20.64) to wireless client(192.168.21.68) to simulate a traffic flow.

Address 1: RA=DA (Receiver Address= Destination Address)
Address 2: TA=BSSID (Transmitter Address= Basic Service Set Identifier)
Address 3: SA (Source Address)

In my case since traffic is coming from 192.168.20.64 to 192.168.21.68, 3850 switch change source of the L2 frame to vlan21 MAC address (gateway for vlan 21) when it send frames to client in vlan 21. Therefore 3 addresses fields content looks like this

Address 1: RA=DA – 04:f7:e4:ea:5b:66 (iPhone5 802.11 MAC)
Address 2: TA=BSSID – b8:38:61:99:1a:af
Address 3: SA – 58:8f:ea:b6:56:e8 (vlan 21 gateway MAC in 3850)

To DS=1, From DS=0
In this scenario traffic is going from wireless client to wired side (To DS=1). So addressing fields consist following information.

Address 1: RA=BSSID (Receiver Address=Basic Service Set Identifier)
Address 2: TA=SA (Transmitter Address= Source Address)
Address 3: DA (Destination Address)

I have taken ICMP echo response going from wireless client as sample frame. In this case as well Destination Address set to vlan21 MAC address.

Address 1: RA=BSSID – b8:38:61:99:1a:af
Address 2: TA=SA – 04:f7:e4:ea:5b:66 (iPhone5 802.11 MAC)
Address 3: DA – 58:8f:ea:b6:56:e8 (vlan 21 gateway MAC in 3850)

To DS=1, From DS=1
In situations where WDS – Wireless Distribution System (eg Bridges, Mesh AP, Repeaters) in use, all 4 address fields used. So address fields should be like this.

Address 1: RA (Receiver Address)
Address 2: TA (Transmitter Address)
Address 3: DA (Destination Address)
Address 3: SA (Source Address)

I have taken wireless capture when 7965 communicating with 7921 across a wireless bridge shown in the below.(Read this post for config involved)

Here is a data frame capture for a packet going from 7965 (192.168.2.5) to 7921 (192.168.140.83) wireless phone. Address field information is like this.

Address 1: RA – a4:0c:c3:1a:ee:60 (AAP1 802.11 BSSID for SSID-MGMT)
Address 2: TA – 64:ae:0c:93:75:90 (AAP2 802.11 BSSID for SSID-MGMT)
Address 3: DA – 00:1a:e3:a7:ff:40 (vlan 2 gateway MAC in C3750)
Address 4: SA – c8:f9:f9:d7:3b:a7 (7965 MAC address)

References
1. CWAP Official Study Guide – Chapter 3