Wireshark-users: Re: [Wireshark-users] What (RA) next to destination MAC addr. stands for?
From: Guy Harris <[email protected]>
Date: Tue, 29 Sep 2009 09:32:29 -0700
On Sep 29, 2009, at 5:59 AM, [email protected] wrote:

I have searched a bit, but I couldn't find what (RA) located next to
destination MAC address stands for?
Recipient Address.

802.11 is not like Ethernet (802.3), where a packet is always sent directly from the link-layer sender to the link-layer recipient; if you're on a network with an access point, packets are sent to the access point, which relays them to the recipient.
For data frames, this means that the frame might have a "destination  
address", which is the intended final link-layer recipient of the  
frame, and a "recipient address", which is the machine that will be  
receiving the frame as sent.  A frame sent from a host (station) to an  
access point has tthe recipient address (RA) set to the MAC address of  
the access point and the destination address (DA) set to the MAC  
address of the ultimate recipient.  When that frame is then sent by  
the access point to the ultimate recipient, the same field will be  
used for the recipient address and the destination address, and that  
field will be set to the MAC address of the ultimate recipient.
See, for example, IEEE Std 802.11-2007:

	http://standards.ieee.org/getieee802/download/802.11-2007.pdf

section 7, and see earlier sections for a description of the concepts involved, although reading the 802.11 standard is probably a bit like taking a drink from a fire hose; you might want to search for an online 802.11 tutorial - Googling for
	802.11 tutorial

found, for example:

	http://sss-mag.com/pdf/802_11tut.pdf