Study guide
7.3 MAC Frame Format and Addressing
CWNA Certified Wireless Network Administrator CWNA-109
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 CWNA-109 Knowledge Domains and Study Strategy
2 RF Fundamentals
2.1 RF Waves, Propagation, Gain and Loss 2.2 Reflection, Multipath, VSWR and Free-Space Path Loss 2.3 RF Units and the Rule of 10s and 3s
3 RF Measurement and Antenna Systems
3.1 Noise Floor, SNR, RSSI and EIRP 3.2 Line of Sight, Fresnel Zone, Polarization and MIMO 3.3 Antenna Types, Charts, Cables and Lightning Protection
4 Industry Bodies and Legacy PHY
4.1 Industry Organizations and OSI Layers 4.2 Legacy 802.11 PHY Standards 4.3 Spread Spectrum, Modulation and MCS
5 Modern 802.11 PHY and Channel Concepts
5.1 Wi-Fi 4 HT and Wi-Fi 5 VHT 5.2 Wi-Fi 6 and Wi-Fi 6E High Efficiency 5.3 Primary Channels, OBSS, Throughput and Guard Interval
6 Spectrum Rules and WLAN Use Cases
6.1 Frequency Bands, DFS and Transmit Power Control 6.2 WLAN, Bridging, Peer-to-Peer and Mesh
7 802.11 Service Sets and Framing
7.1 Stations, BSS, ESS and the Distribution System 7.2 MSDU, MPDU, PSDU, PPDU and Aggregation 7.3 MAC Frame Format and Addressing
8 Frame Types, Discovery, and Association
8.1 Management, Control and Data Frames 8.2 Scanning, Authentication and Association
9 Channel Access, MAC Operations, and Devices
9.1 DCF, EDCA, RTS/CTS and Interframe Spaces 9.2 Roaming, Power Save and Protection Mechanisms 9.3 Access Points, Controllers and Client Devices
10 PoE, Architectures, and Proprietary Features
10.1 Power over Ethernet, PSE and Power Budgets 10.2 Centralized vs Distributed Forwarding and Network Planes 10.3 Airtime Fairness, Band Steering and RRM
11 WLAN Design and Supporting Services
11.1 Data, Voice, Video and Legacy Client Design 11.2 High-Density, Location Services and Guest Access 11.3 DHCP, DNS, Time, VLANs and AAA
12 WLAN Security
12.1 Weak and Deprecated WLAN Security 12.2 AES, WPA2-Personal and WPA2-Enterprise 12.3 WPA3, SAE and Opportunistic Wireless Encryption 12.4 PMF, Fast Roaming, WIPS and Secure Management
13 RF Validation Surveys and Tools
13.1 Post-Implementation Validation Surveys 13.2 Application and Performance Testing 13.3 Validation Tools: Survey, Protocol and Spectrum
14 Interference, Troubleshooting, and Common Faults
14.1 Co-Channel Contention vs Adjacent Channel Interference 14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring 14.3 Common WLAN Faults and Hidden Nodes
7.3 MAC Frame Format and Addressing
Key Takeaways Explain This Topic AI
An 802.11 MAC frame includes Frame Control, Duration/ID, address fields, Sequence Control, optional QoS and HT Control, body, and FCS
Address 1 is always the receiver address for this radio hop and is not always the access point
Ordinary infrastructure data uses three addresses; Address 4 appears only when To DS and From DS are both 1
To DS=1 and From DS=0 marks STA-to-AP data; To DS=0 and From DS=1 marks AP-to-STA data
- Four-address frames carry RA, TA, DA, and SA across a wireless DS, WDS bridge, or mesh-style hop
- Last updated: September 2026
Harborline’s ESS is now in place, and you can name MSDU versus PPDU. The next skill is reading the MAC header the way a protocol analyzer draws it. Ethernet used two addresses. 802.11 often uses three , and sometimes four , because a frame must name both the radio hop (who transmits and who receives this PPDU) and the end stations (original source and final destination) when those are not the same pair.
MAC frame layout
Every 802.11 MAC frame is MAC header + frame body + FCS , with fields in a fixed order . Not every field is present in every subtype. The first three fields ( Frame Control , Duration/ID , Address 1 ) and the last field ( FCS ) are the minimum set—ACK and CTS look that small on purpose.
- Field Size Always present? Role
- Frame Control (FC) 2 bytes Yes Type/subtype, To DS, From DS, retry, power management, protected, +HTC
- Duration/ID 2 bytes Yes NAV duration in microseconds, or AID in a PS-Poll
- Address 1 6 bytes Yes Receiver address (RA) for this hop
- Address 2 6 bytes Most frames Transmitter address (TA)
- Address 3 6 bytes Management and data Remaining BSSID, SA, or DA
- Sequence Control 2 bytes Management and data 12-bit sequence number + 4-bit fragment number
- Address 4 6 bytes Only To DS=1 and From DS=1 Fourth MAC address on a wireless DS hop
- QoS Control 2 bytes QoS data TID, ACK policy, A-MSDU Present, TXOP-related bits
- HT Control 4 bytes When +HTC is set HT / VHT / HE control (link adaptation awareness)
- Frame body Variable Depends on subtype MSDU, A-MSDU, or management information elements
- FCS 4 bytes Yes 32-bit CRC over MAC header and body
Typical management frames use a 24-byte header (FC, Duration, three addresses, Sequence Control) plus body and FCS. QoS data adds QoS Control. Wireless DS data adds Address 4. Control frames such as ACK omit most of that.
Frame Control bits you must recognize
Protocol Version is normally 0. Type (2 bits) and Subtype (4 bits) name management, control, or data and the specific subtype (Beacon, ACK, QoS Data, and so on). The next chapter spends its time on those three types; this section needs the bits that drive addressing .
To DS and From DS are the two bits that decide how Addresses 1–4 are interpreted on data frames:
To DS = 1 means “this frame is going into the Distribution System” (a non-AP STA sending toward its AP, or a wireless-DS hop that is entering the DS).
From DS = 1 means “this frame is coming out of the Distribution System” (an AP sending toward a non-AP STA, or a wireless-DS hop that is leaving the DS).
Other FC bits you should recognize by name: More Fragments , Retry , Power Management , More Data (AP has buffered frames for a sleeping STA), Protected Frame (the body is encrypted), and +HTC / Order (HT Control present on frames that use it).
Duration/ID, Sequence, QoS, HT Control, body, FCS
Duration/ID usually carries a microsecond duration that other STAs copy into their NAV (virtual carrier sense). On a PS-Poll , the same two bytes carry the STA’s AID instead. Duration is not a timestamp and not a sequence number.
Sequence Control splits into a 4-bit fragment number and a 12-bit sequence number . Receivers use the pair to detect duplicates (Retry copies the same sequence) and to reassemble fragments. A-MPDU Block ACK bitmaps also speak in sequence-number language.
QoS Control appears on QoS data. TID maps user priority onto an access category. ACK policy can request Normal Ack, No Ack, or Block Ack. The A-MSDU Present bit tells the receiver the body is an A-MSDU, not a lone MSDU—so Address 3 interpretation can change in analyzer views.
HT Control (4 bytes) is an awareness topic for CWNA: when the +HTC bit is set, this field can carry HT, VHT, or HE control information used for link adaptation and similar PHY feedback. You do not need every A-Control subfield; you do need to know the field exists after QoS Control when present, and that it is not a fifth MAC address.
The frame body is the variable payload: MSDU or A-MSDU for data, information elements for management, often empty for ACK. The FCS is a 32-bit CRC covering the MAC header and body. It does not cover the PHY preamble or PHY header. A bad FCS drops the MPDU; that is why A-MPDU can salvage sibling MPDUs that still pass their own FCS.
The Address 1 trap
Address 1 is the receiver of this radio hop. It is not always the AP.
When a Harborline scanner sends uplink data to AP-Aisle-1, Address 1 is the AP BSSID—the AP is the radio that must receive this PPDU. When AP-Aisle-1 sends downlink data to that scanner, Address 1 is the scanner MAC . The AP is Address 2 (transmitter). If you memorized “Address 1 = AP,” every downlink frame in a capture will look backwards.
ACK and CTS are extreme examples: they may contain little more than FC, Duration, Address 1, and FCS. Address 1 is still the intended receiver of that control frame, which might be the AP or the client depending on who is being ACKed.
Always decode:
- Address 1 = RA (who should receive this transmission)
- Address 2 = TA (who is transmitting this transmission)
- Address 3 / 4 complete the DA / SA / BSSID story depending on To DS and From DS
- Three addresses versus four
Infrastructure BSS data on a wired DS uses three addresses. Four-address frames appear when both To DS and From DS are 1: the radio hop is AP-to-AP (or mesh STA-to-mesh STA) while the original DA and SA still need to travel. That is wireless DS / WDS / mesh-style addressing, not Harborline’s everyday Ethernet uplink.
- To DS From DS Address 1 (RA) Address 2 (TA) Address 3 Address 4 Harborline reading
- 0 0 DA SA BSSID — IBSS data, or most management
- 1 0 BSSID SA (scanner) DA (for example WMS) — Scanner to aisle AP
- 0 1 DA (scanner) BSSID SA (for example WMS) — Aisle AP to scanner
- 1 1 RA (receiving AP) TA (transmitting AP) DA SA Wireless DS / WDS / mesh-style hop
Uplink (To DS=1, From DS=0): the scanner is the transmitter (Address 2) and names the AP BSSID as receiver (Address 1). Address 3 holds the destination MAC the DS should deliver to—often the WMS server or default gateway MAC after the AP bridges onto Ethernet.
Downlink (To DS=0, From DS=1): the AP is the transmitter (Address 2 = BSSID). Address 1 is the client . Address 3 holds the original source on the DS side. This is the frame that punishes the “Address 1 is always the AP” mnemonic.
Four-address (To DS=1, From DS=1): suppose Harborline later bridges an overflow tent with a wireless DS hop between two APs. The on-air hop needs RA and TA (the two AP radios) and the original DA and SA (scanner and server). That fourth address is Address 4 . Ethernet-backhaul Harborline APs do not need Address 4 on the client hop; the wired DSM carries SA/DA in the Ethernet header instead.
IBSS data uses To DS=0, From DS=0 with DA, SA, and BSSID in Addresses 1–3 and no Address 4. There is no DS to enter.
Putting a Harborline capture together
A QoS data MPDU from scanner AA:AA:AA:AA:AA:01 associated to AP-Aisle-1 BSSID 00:11:22:33:44:01 , destined to WMS BB:BB:BB:BB:BB:10 :
- FC: Type = Data, QoS subtype, To DS=1, From DS=0
- Address 1 = 00:11:22:33:44:01 (AP is the receiver )
- Address 2 = AA:AA:AA:AA:AA:01 (scanner is the transmitter )
- Address 3 = BB:BB:BB:BB:BB:10 (WMS is the destination )
- Address 4 omitted
- QoS Control present; HT Control only if +HTC is set
- Body = MSDU (or A-MSDU); FCS last
The AP strips the 802.11 header, forwards an Ethernet frame with destination BB:BB:BB:BB:BB:10 onto the DSM, and the switching fabric does the rest. The reverse frame flips To DS/From DS and puts the scanner in Address 1.
If you can name every field in order, state when Address 4 exists, and refuse the Address-1-is-always-the-AP trap, Objective 3.3 is doing its job.