The IEEE 802.11 Frame · Mobility in the Same IP Subnet

An 802.11 frame carries four address fields where Ethernet needs two. The access point between the wireless and wired worlds has to translate, and translation needs to know where a datagram came from.

Words you will meet

Address 3 — the MAC (Media Access Control) address of the router interface for this subnet. The unusual one.
Duration — how long the channel is reserved, from section 7.3.2’s RTS (Request to Send) and CTS (Clear to Send) exchange.
Sequence control — tells a retransmission from a new frame, exactly as in section 3.4.1.
Disassociate — leaving one AP (access point) , which a moving station does before joining the next.

Why this matters

Section 7.3.1 said an access point is a link-layer device that does not speak IP (Internet Protocol) . This page shows what that costs.

An AP (access point) sits between a wireless world and a wired one and must convert every frame between them, in both directions, without understanding anything above the link layer. Ethernet’s two addresses are not enough information to do that, and address 3 is the missing piece.

Then §7.3.4 asks a question that sounds like it should be hard and turns out not to be: what happens when you walk from one access point to another?

The frame

Figure 7.13 — the 802.11 frame

Click any box to read what that part of the message is for.

Every field, as text

Nine fields. Widths in bytes, drawn roughly to scale for the header — the payload would be far wider than everything else combined. Click any field.

The payload is typically fewer than 1,500 bytes, holding an IP datagram or an ARP (Address Resolution Protocol) packet. So section 6.4.2’s Ethernet MTU (maximum transmission unit) still governs in practice, even though 802.11 would allow up to 2,312.

The frame control field, expanded

Click any box to read what that part of the message is for.

Every field, as text

Protocol version — 2 bits — which 802.11 this is (example: 0)
Type — 2 bits — management, control or data (example: 10)
Subtype — 4 bits — which kind, within the type (example: 0000)
To AP — 1 bits — redefines what the address fields mean (example: 1)
From AP — 1 bits — the other half of that pair (example: 0)
More frag — 1 bits — more fragments follow (example: 0)
Retry — 1 bits — this is a retransmission (example: 0)
Power mgt — 1 bits — the sender’s power-saving state (example: 0)
More data — 1 bits — the sender has more queued (example: 0)
WEP — 1 bits — is encryption in use? (example: 0)
Rsvd — 1 bits — reserved (example: 0)

Sixteen bits, eleven fields. Widths in bits.

The To AP and From AP bits are worth noticing. They redefine what the four address fields mean. It differs between ad hoc and infrastructure mode, and within infrastructure mode it differs again depending on whether a station or an AP is transmitting. Four fields whose meaning is set by two bits elsewhere in the same frame.

Four addresses, and why

In plain words

The book calls this the most striking difference from an Ethernet frame, and asks the obvious question: does a source and a destination not suffice?

Three are needed for internetworking — getting a datagram from a wireless station, through an AP, to a router interface. The fourth is for ad hoc mode, when APs forward frames to each other, and plays no part in this chapter.

Figure 7.14 — why three addresses, in both directions

The setting: a router that has no idea the AP existsstep 1 of 5

Router interface R1 connects to the subnet. Two APs hang off it, each with its own stations. An AP is a link-layer device — it does not speak IP and does not understand IP addresses. From R1’s point of view, H1 is simply a host on one of its subnets.

Five steps, and the pay-off is the last two. Ethernet needs two addresses because a frame only ever crosses one link. An 802.11 frame crosses one link too — but its AP has to translate, and translation needs to know where the datagram came from or is going.

Read all steps as text

The setting: a router that has no idea the AP exists — Router interface R1 connects to the subnet. Two APs hang off it, each with its own stations. An AP is a link-layer device — it does not speak IP and does not understand IP addresses. From R1’s point of view, H1 is simply a host on one of its subnets.
R1 → H1: the router builds an ordinary Ethernet frame — R1 knows H1’s IP address from the datagram, and uses ARP to get H1’s MAC address — exactly as on any Ethernet LAN. Source R1, destination H1. Two addresses, as chapter 6 would expect.
The AP converts it, and fills in three addresses — Address 1 is H1 (the receiver), address 2 is the AP itself (the transmitter), and address 3 is R1. That third field is how H1 learns which router interface put this datagram into the subnet.
H1 → R1: the same three fields, differently filled — H1 replies. Address 1 is the AP (the receiver on this link), address 2 is H1 (the transmitter), and address 3 is R1 again — but now it is doing the opposite job.
So address 3 works in both directions — Going down, it tells the station which router sent the datagram in. Coming up, it tells the AP which router to address the Ethernet frame to. One field, two jobs, and neither of them possible with Ethernet’s two addresses.

Read the last two steps together. Address 3 does opposite jobs in opposite directions, and both are things an AP could not otherwise know:

Going down to the station, it says which router interface sent this datagram into the subnet.
Coming up from the station, it says which router interface to address the Ethernet frame to.

Where the frame differs from Ethernet’s

802.11 field	Ethernet equivalent	Why 802.11 needs it

Cells marked ⓘ have an explanation — click to read it.

Six fields Ethernet has no equivalent for, and one it does. Click a row.

Walking from one access point to another

To cover more ground, an organisation deploys several BSSs. Which raises the obvious question: what happens to your open connections when you walk between them?

Figure 7.15 — moving between BSSs on one subnet

Two BSSs, one subnet, one switchstep 1 of 4

Universities and companies deploy several BSSs to cover more ground. The device joining them here is a switch, not a router — so every station and both APs are on the same IP subnet.

The last step is a nice joke on chapter 6. Nothing new was invented — AP2 simply sends a frame whose source address is somebody else’s, and the switch’s ordinary self-learning does the rest.

Read all steps as text

Two BSSs, one subnet, one switch — Universities and companies deploy several BSSs to cover more ground. The device joining them here is a switch, not a router — so every station and both APs are on the same IP subnet.
H1 wanders, and re-associates — H1 detects a weakening signal from AP1 and scans for a stronger one. It finds AP2’s beacons — in a corporate or university setting, very likely with the same SSID. It disassociates from AP1 and associates with AP2.
But the switch still thinks H1 is behind AP1 — Section 6.4.3’s self-learning table has an entry pairing H1’s MAC address with the interface leading to AP1. Until something changes it, frames for H1 keep going the wrong way.
The fix, which the book calls a bit of a hack — Just after the association, AP2 sends a broadcast Ethernet frame carrying H1’s source address to the switch. The switch does what it always does with a source address — learns it — and updates its table to point at AP2.

Everything here depends on that box being a switch

In Figure 7.15 the device joining the two BSSs is a switch, so every station and both APs are on the same IP subnet. H1 keeps its IP address and every open TCP (Transmission Control Protocol) connection survives.

Make it a router instead and the picture changes completely. H1 would have to obtain a new IP address on the subnet it moved into — and that change would disrupt, and eventually kill, every TCP connection it had open.

That is the harder problem, and it is what sections 7.5 and 7.6 exist to solve. This section is the easy case, and it is easy only because nothing above the link layer notices anything happened.

The handover itself is undramatic. H1 notices AP1’s signal weakening, scans, finds AP2’s beacons — usually with the same SSID (Service Set Identifier) , in a university or office — then disassociates from AP1 and associates with AP2.

But the switch still has a stale entry. Its self-learning table from section 6.4.3 pairs H1’s MAC address with the interface towards AP1, and frames for H1 keep going that way.

In plain words — and the fix is a good joke

Switches self-learn beautifully for occasional moves, like an employee changing department. They were never designed for someone walking across a building while holding a TCP connection open.

So AP2 sends a broadcast Ethernet frame carrying H1’s source address to the switch, immediately after the association. The switch does exactly what section 6.4.3 says it always does — learns from the source address — and repoints its entry at AP2.

Nothing new was invented. AP2 simply sends a frame claiming to be from somebody else, and ordinary self-learning does the rest. The book calls it “a bit of a hack, really”, and it is.

Check yourself

0 of 7 answered

1.An 802.11 frame has four address fields. What are the first three for?
2.predictAn AP transmits a frame to station H1. What goes in addresses 1, 2 and 3?
3.Why can Ethernet manage with two addresses when 802.11 needs three?
4.What does the sequence control field do, and where have you seen its job before?
5.predictH1 walks from BSS1 to BSS2, and the two are joined by a switch. What happens to its open TCP connections?
6.predictReplace the switch joining the two BSSs with a router. What changes?
7.After H1 re-associates with AP2, the switch still sends its frames towards AP1. How is that fixed?

What to remember

Four address fields, not two. Address 2 is the transmitter, address 1 the receiver — the pair Ethernet would have. Address 3 is the router interface, which tells a station who sent a datagram in and tells the AP where to send one out.
The To AP / From AP bits redefine what the address fields mean, so the frame’s own header says how to read itself.
Moving between BSSs on one subnet is easy: re-associate, keep your IP address, keep your TCP connections. The switch is fixed by a broadcast frame with H1’s source address — self-learning used as a tool rather than a mechanism.