Wireshark · Ethereal-users: RE: [Ethereal-users] How to check which AP data is coming from?

["Joshua Wright" <Joshua.Wright@xxxxxxx>]

The BSSID address in the 802.11 MAC (the third address) is unique for each AP.  In infrastructure-based networks (WLAN networks using access-points), this is the same address as the wireless NIC on the AP.  In ad-hoc networks, this is a randomly selected address.

Note that you won't typically see four address in the 802.11 header unless you are using WDS for LAN to LAN bridging.  The fourth address is simply omitted when the TODS and FROMDS bits are set in the frame control flags portion of the MAC header.

-Joshua Wright
Senior Network and Security Architect
Johnson & Wales University
Joshua.Wright@xxxxxxx 
http://home.jwu.edu/jwright/

pgpkey: http://home.jwu.edu/jwright/pgpkey.htm
fingerprint: FDA5 12FC F391 3740 E0AE BDB6 8FE2 FC0A D44B 4A73

> Is there any way to check from which AP the data is
> coming from? Does the 4 addresses in MAC header
> contains AP address for a data packet?