802.11 Address Fields and the Four-Address Distribution System

An Ethernet frame has two addresses: who sent it and who should receive it. A Wi-Fi data frame has a header that can hold four, and the two bits that decide which address is in which position are not in the address fields at all — they are two flags in the Frame Control field. The arrangement looks redundant until you consider that a Wi-Fi frame may be travelling between a station and an access point, and the access point is a bridge, so the frame is simultaneously a wireless frame and a bridged Ethernet frame with different notions of source and destination.

What each address position means

Every 802.11 data frame carries at least three addresses, and the roles they play are defined by where the frame is in its journey rather than by its content.

The first field, Addr1, carries the receiver address: the station that must decode the frame over the air at this hop. It is the address the physical and MAC layers use for acknowledgement and for address filtering. The second, Addr2, carries the transmitter address: the station that radiated the frame. The remaining positions hold the destination and source of the MAC-level conversation, which may be on the wired side of the AP.

For a frame sent by a station to its AP, Addr1 is the AP’s address and Addr2 is the station’s address. The third address is the destination on the distribution system. If the destination is a wired host, that is the host’s MAC address; the AP forwards the frame onto Ethernet with the destination in the Ethernet destination field and the station’s address as the Ethernet source.

For a frame sent by the AP to a station, Addr1 is the station’s address and Addr2 is the AP’s address. The third address is the original source, which may be a wired host or another wireless station.

ToDS and FromDS

The two flags that disambiguate the four positions are ToDS and FromDS, both in the Frame Control field. A frame from a station to the AP has ToDS set and FromDS clear. A frame from the AP to a station has FromDS set and ToDS clear. A frame between two stations in an independent network, with no AP, has both clear. A frame between two APs in a wireless distribution system has both set, which is where the fourth address appears.

ToDS	FromDS	Addr1	Addr2	Addr3	Addr4
0	0	destination	source	BSSID	absent
0	1	destination	BSSID (AP)	source	absent
1	0	BSSID (AP)	source	destination	absent
1	1	receiver AP	transmitter AP	destination	source

The table is worth reading as a set of invariants rather than memorising. Addr1 is always the station that must acknowledge the frame at this hop. Addr2 is always the station that transmitted it. When the frame crosses the distribution system, the ultimate source and destination occupy Addr3 and sometimes Addr4.

The frame body length is bounded by the maximum payload, and the header length depends on which addresses are present. A three-address frame header is 24 bytes; adding the fourth address brings it to 30. Every frame also carries a 4-byte frame check sequence. The total per-frame overhead before any security encapsulation is therefore 28 or 34 bytes, which is one of the reasons aggregation matters so much on a network whose payloads are often a few hundred bytes.

What the distribution system actually is

The distribution system is the abstract service that moves frames between basic service sets. In the common deployment it is an Ethernet LAN: the AP has a wired port, and frames it forwards appear on that port as ordinary Ethernet frames. The AP’s job at the MAC layer is to translate between the wireless frame format and the Ethernet format, dropping the addresses that the wired side does not need and keeping the ones it does.

That translation is where the fourth address earns its place. When two APs are connected wirelessly — a wireless distribution system — a frame may need to name the station that sent it, the AP that received it, the AP that will transmit it, and the final destination. Four addresses, and both ToDS and FromDS set, is the only encoding that can express it.

The encoding is also a warning. Because the fourth address is only present when both flags are set, a receiver that mis-parses the flags starts reading the payload six bytes early and computes the frame check over the wrong span. Nothing in the frame announces its own header length beyond the flags, so a driver that guesses gets silent corruption rather than an error.

Address filtering and the three-address trap

A station’s receive filter is not simply “is Addr1 my address”. 802.11 requires a station to accept frames where Addr1 is its own address, where Addr1 is a group address it has joined, or where the frame is a management frame of a type it must handle. Everything else is dropped without acknowledgement, which is what keeps a station from spending power on other stations’ traffic.

The filter creates a specific failure when a wireless link is bridged into a wired network carelessly. Suppose a station is associated to AP1 and the frame is addressed to a host on the wired LAN. Addr1 is AP1, Addr3 is the host. AP1 forwards it to Ethernet correctly. Now suppose the same frame arrives at AP1 over the wireless distribution system from AP2. Addr1 is AP1, Addr2 is AP2, Addr3 is the host, Addr4 is the station. If AP1’s driver is written to the three-address case only, it will treat Addr3 as the destination and forward correctly by accident, because the destination is in the same position in both encodings. The source is what differs, and a bridge that learns the wrong source address installs a forwarding entry pointing at the wrong port, which produces a loop or a black hole that appears only for traffic originating behind the other AP.

The rule that prevents this is to derive the Ethernet source from Addr4 when both flags are set, and from Addr2 otherwise. Getting it wrong produces a network that works until a second AP is added, then fails in a way that looks like a spanning-tree problem.

Where the addresses stop being enough

Three-address encoding assumes one AP between the wireless station and the wired network. Any design that stacks more than one bridge in the wireless path needs either the four-address form or a tunnel that hides the intermediate hops. The four-address form is not universally supported: many client drivers ignore frames with both flags set, because the encoding is used only between APs and clients have no reason to handle it.

The second limit is that addresses are flat. A station that moves between APs keeps its MAC address, but the distribution system must know which AP currently reaches it. That is a learning problem, solved either by flooding and learning, as a bridge does, or by a controller that tracks associations. Neither is part of the MAC frame format, which is why roaming behaviour is governed by the management frames rather than by anything in the header. The mechanisms that make a move between APs quick enough for a call to survive are covered in Roaming, fast transition, and BSS selection.

The third limit is privacy. The addresses in the header are visible to anyone listening, and they are stable identifiers. A station that randomises its MAC address per network, as modern client stacks do, changes what the distribution system sees on each association; the AP’s learning and the network’s access control must cope with an address that is no longer an identity. Address randomisation is a client behaviour, but it lands on the bridge’s forwarding table as a stream of new sources.

Frames that carry no payload addresses at all

Control frames are shorter than data frames and carry fewer addresses. An acknowledgement carries only the receiver address: 2 bytes of frame control, 2 of duration, 6 of address, and 4 of check sequence, 14 bytes in total. A CTS carries the receiver address, and an RTS carries receiver and transmitter. None of them carry source or destination in the distribution-system sense, because they exist only for the current hop.

Management frames carry three addresses in the same positions as the three-address data form — destination, source, and BSSID — and their frame control bits do not select between encodings at all. A beacon is addressed to the broadcast address with the AP as source and its own BSSID in the third position, which is how a station scanning the channel learns which network a frame belongs to without having to parse the body.

The result is that the address fields are a compact encoding of a frame’s position in a two-hop path, with the flags acting as the selector. Once the four combinations are understood, the header layout stops looking arbitrary: it is the minimum number of addresses needed to express every path the standard permits, and no more. The per-frame cost of this header, 24 bytes before the check sequence, is one of the quantities that A-MPDU aggregation and block acknowledgement exists to amortise.