7.3 MAC Frame Format and Addressing
Key Takeaways
- An 802.11 MAC frame includes Frame Control, Duration/ID, address fields, Sequence Control, optional QoS and HT Control, body, and FCS
- Address 1 is always the receiver address for this radio hop and is not always the access point
- Ordinary infrastructure data uses three addresses; Address 4 appears only when To DS and From DS are both 1
- To DS=1 and From DS=0 marks STA-to-AP data; To DS=0 and From DS=1 marks AP-to-STA data
- Four-address frames carry RA, TA, DA, and SA across a wireless DS, WDS bridge, or mesh-style hop
Harborline’s ESS is now in place, and you can name MSDU versus PPDU. The next skill is reading the MAC header the way a protocol analyzer draws it. Ethernet used two addresses. 802.11 often uses three, and sometimes four, because a frame must name both the radio hop (who transmits and who receives this PPDU) and the end stations (original source and final destination) when those are not the same pair.
MAC frame layout
Every 802.11 MAC frame is MAC header + frame body + FCS, with fields in a fixed order. Not every field is present in every subtype. The first three fields (Frame Control, Duration/ID, Address 1) and the last field (FCS) are the minimum set—ACK and CTS look that small on purpose.
| Field | Size | Always present? | Role |
|---|---|---|---|
| Frame Control (FC) | 2 bytes | Yes | Type/subtype, To DS, From DS, retry, power management, protected, +HTC |
| Duration/ID | 2 bytes | Yes | NAV duration in microseconds, or AID in a PS-Poll |
| Address 1 | 6 bytes | Yes | Receiver address (RA) for this hop |
| Address 2 | 6 bytes | Most frames | Transmitter address (TA) |
| Address 3 | 6 bytes | Management and data | Remaining BSSID, SA, or DA |
| Sequence Control | 2 bytes | Management and data | 12-bit sequence number + 4-bit fragment number |
| Address 4 | 6 bytes | Only To DS=1 and From DS=1 | Fourth MAC address on a wireless DS hop |
| QoS Control | 2 bytes | QoS data | TID, ACK policy, A-MSDU Present, TXOP-related bits |
| HT Control | 4 bytes | When +HTC is set | HT / VHT / HE control (link adaptation awareness) |
| Frame body | Variable | Depends on subtype | MSDU, A-MSDU, or management information elements |
| FCS | 4 bytes | Yes | 32-bit CRC over MAC header and body |
Typical management frames use a 24-byte header (FC, Duration, three addresses, Sequence Control) plus body and FCS. QoS data adds QoS Control. Wireless DS data adds Address 4. Control frames such as ACK omit most of that.
Frame Control bits you must recognize
Protocol Version is normally 0. Type (2 bits) and Subtype (4 bits) name management, control, or data and the specific subtype (Beacon, ACK, QoS Data, and so on). The next chapter spends its time on those three types; this section needs the bits that drive addressing.
To DS and From DS are the two bits that decide how Addresses 1–4 are interpreted on data frames:
- To DS = 1 means “this frame is going into the Distribution System” (a non-AP STA sending toward its AP, or a wireless-DS hop that is entering the DS).
- From DS = 1 means “this frame is coming out of the Distribution System” (an AP sending toward a non-AP STA, or a wireless-DS hop that is leaving the DS).
Other FC bits you should recognize by name: More Fragments, Retry, Power Management, More Data (AP has buffered frames for a sleeping STA), Protected Frame (the body is encrypted), and +HTC / Order (HT Control present on frames that use it).
Duration/ID, Sequence, QoS, HT Control, body, FCS
Duration/ID usually carries a microsecond duration that other STAs copy into their NAV (virtual carrier sense). On a PS-Poll, the same two bytes carry the STA’s AID instead. Duration is not a timestamp and not a sequence number.
Sequence Control splits into a 4-bit fragment number and a 12-bit sequence number. Receivers use the pair to detect duplicates (Retry copies the same sequence) and to reassemble fragments. A-MPDU Block ACK bitmaps also speak in sequence-number language.
QoS Control appears on QoS data. TID maps user priority onto an access category. ACK policy can request Normal Ack, No Ack, or Block Ack. The A-MSDU Present bit tells the receiver the body is an A-MSDU, not a lone MSDU—so Address 3 interpretation can change in analyzer views.
HT Control (4 bytes) is an awareness topic for CWNA: when the +HTC bit is set, this field can carry HT, VHT, or HE control information used for link adaptation and similar PHY feedback. You do not need every A-Control subfield; you do need to know the field exists after QoS Control when present, and that it is not a fifth MAC address.
The frame body is the variable payload: MSDU or A-MSDU for data, information elements for management, often empty for ACK. The FCS is a 32-bit CRC covering the MAC header and body. It does not cover the PHY preamble or PHY header. A bad FCS drops the MPDU; that is why A-MPDU can salvage sibling MPDUs that still pass their own FCS.
The Address 1 trap
Address 1 is the receiver of this radio hop. It is not always the AP.
When a Harborline scanner sends uplink data to AP-Aisle-1, Address 1 is the AP BSSID—the AP is the radio that must receive this PPDU. When AP-Aisle-1 sends downlink data to that scanner, Address 1 is the scanner MAC. The AP is Address 2 (transmitter). If you memorized “Address 1 = AP,” every downlink frame in a capture will look backwards.
ACK and CTS are extreme examples: they may contain little more than FC, Duration, Address 1, and FCS. Address 1 is still the intended receiver of that control frame, which might be the AP or the client depending on who is being ACKed.
Always decode:
- Address 1 = RA (who should receive this transmission)
- Address 2 = TA (who is transmitting this transmission)
- Address 3 / 4 complete the DA / SA / BSSID story depending on To DS and From DS
Three addresses versus four
Infrastructure BSS data on a wired DS uses three addresses. Four-address frames appear when both To DS and From DS are 1: the radio hop is AP-to-AP (or mesh STA-to-mesh STA) while the original DA and SA still need to travel. That is wireless DS / WDS / mesh-style addressing, not Harborline’s everyday Ethernet uplink.
| To DS | From DS | Address 1 (RA) | Address 2 (TA) | Address 3 | Address 4 | Harborline reading |
|---|---|---|---|---|---|---|
| 0 | 0 | DA | SA | BSSID | — | IBSS data, or most management |
| 1 | 0 | BSSID | SA (scanner) | DA (for example WMS) | — | Scanner to aisle AP |
| 0 | 1 | DA (scanner) | BSSID | SA (for example WMS) | — | Aisle AP to scanner |
| 1 | 1 | RA (receiving AP) | TA (transmitting AP) | DA | SA | Wireless DS / WDS / mesh-style hop |
Uplink (To DS=1, From DS=0): the scanner is the transmitter (Address 2) and names the AP BSSID as receiver (Address 1). Address 3 holds the destination MAC the DS should deliver to—often the WMS server or default gateway MAC after the AP bridges onto Ethernet.
Downlink (To DS=0, From DS=1): the AP is the transmitter (Address 2 = BSSID). Address 1 is the client. Address 3 holds the original source on the DS side. This is the frame that punishes the “Address 1 is always the AP” mnemonic.
Four-address (To DS=1, From DS=1): suppose Harborline later bridges an overflow tent with a wireless DS hop between two APs. The on-air hop needs RA and TA (the two AP radios) and the original DA and SA (scanner and server). That fourth address is Address 4. Ethernet-backhaul Harborline APs do not need Address 4 on the client hop; the wired DSM carries SA/DA in the Ethernet header instead.
IBSS data uses To DS=0, From DS=0 with DA, SA, and BSSID in Addresses 1–3 and no Address 4. There is no DS to enter.
Putting a Harborline capture together
A QoS data MPDU from scanner AA:AA:AA:AA:AA:01 associated to AP-Aisle-1 BSSID 00:11:22:33:44:01, destined to WMS BB:BB:BB:BB:BB:10:
- FC: Type = Data, QoS subtype, To DS=1, From DS=0
- Address 1 =
00:11:22:33:44:01(AP is the receiver) - Address 2 =
AA:AA:AA:AA:AA:01(scanner is the transmitter) - Address 3 =
BB:BB:BB:BB:BB:10(WMS is the destination) - Address 4 omitted
- QoS Control present; HT Control only if +HTC is set
- Body = MSDU (or A-MSDU); FCS last
The AP strips the 802.11 header, forwards an Ethernet frame with destination BB:BB:BB:BB:BB:10 onto the DSM, and the switching fabric does the rest. The reverse frame flips To DS/From DS and puts the scanner in Address 1.
If you can name every field in order, state when Address 4 exists, and refuse the Address-1-is-always-the-AP trap, Objective 3.3 is doing its job.
Address 1 in an 802.11 MAC header is which of the following?
When does an 802.11 data frame include Address 4?
A Harborline scanner sends uplink QoS data to its aisle AP, which has a wired Ethernet DS toward the WMS server. Which To DS / From DS and addressing picture is correct?