ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] What (RA) next to destination MAC addr. stands for?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 29 Sep 2009 09:32:29 -0700

On Sep 29, 2009, at 5:59 AM, ph3arconf@xxxxxxxxx wrote:

I have searched a bit, but I couldn't find what (RA) located next to
destination MAC address stands for?

Recipient Address.

802.11 is not like Ethernet (802.3), where a packet is always sent directly from the link-layer sender to the link-layer recipient; if you're on a network with an access point, packets are sent to the access point, which relays them to the recipient.

For data frames, this means that the frame might have a "destination address", which is the intended final link-layer recipient of the frame, and a "recipient address", which is the machine that will be receiving the frame as sent. A frame sent from a host (station) to an access point has tthe recipient address (RA) set to the MAC address of the access point and the destination address (DA) set to the MAC address of the ultimate recipient. When that frame is then sent by the access point to the ultimate recipient, the same field will be used for the recipient address and the destination address, and that field will be set to the MAC address of the ultimate recipient.

See, for example, IEEE Std 802.11-2007:

	http://standards.ieee.org/getieee802/download/802.11-2007.pdf

section 7, and see earlier sections for a description of the concepts involved, although reading the 802.11 standard is probably a bit like taking a drink from a fire hose; you might want to search for an online 802.11 tutorial - Googling for

	802.11 tutorial

found, for example:

	http://sss-mag.com/pdf/802_11tut.pdf