> For the complete documentation index, see [llms.txt](https://openwrt-nctu.gitbook.io/project/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://openwrt-nctu.gitbook.io/project/experiment-overhear/802.11-packet-format.md).

# 802.11 封包解析

## WiFi header 中的 MAC 位址

參考來源: 

* <http://80211notes.blogspot.com/2013/09/understanding-address-fields-in-80211.html>
* <http://downager.blogspot.com/2014/10/ieee-80211-distribution-system-frame.html>

當我們取得 WiFi 封包之後，有一個目標就是取得發送裝置的 MAC 位址，此資訊出現在 WiFi 封包的 header 中，其格式如下圖所示:

![MAC header](/files/-LOrmrG2iJ9Qmy1ylsNz)

其中，一共有4個 MAC 位址的欄位，而根據不同的 Frame Control 設定，則會有4種不同的填入方式，如下表所示:

| From DS | To DS | Addr 1 | Addr 2 | Addr 3 | Addr 4 |
| ------- | ----- | ------ | ------ | ------ | ------ |
| 0       | 0     | DA     | SA     | BSSID  | N/A    |
| 0       | 1     | BSSID  | SA     | DA     | N/A    |
| 1       | 0     | DA     | BSSID  | SA     | N/A    |
| 1       | 1     | RA     | TA     | DA     | SA     |

以下是縮寫的解說:

* DS: Distribution System，簡單來說，就是 WLAN 之外的節點。
* DA: Destination Address，最終的接收裝置
* SA: Source Address，原始來源位址
* RA: Receiver Address，接收端位址，可以是轉發的裝置
* TA: Transmitter Address，發送端位址，可以是轉傳的裝置
* BSSID:  Basic Service Set IDentifier，WiFi AP 的位址

當 Frame Control 為 (0, 0) 時，傳送端和接收端都在 WLAN 內，所以只需要填兩端的 MAC 位址就可以完成傳送，例如，使用電腦 SSH 連到同樣無線網路內的另一台電腦 (下圖 Laptop A 到 Laptop B)。此類封包除了 WLAN 內的通訊之外，

```
00:54:54.471960 136309555498us tsft 1.0 Mb/s 2412 MHz 11b -34dBm signal -37dBm signal antenna 0 -37dBm signal antenna 1 BSSID:00:22:2d:80:1f:30 DA:ff:ff:ff:ff:ff:ff SA:00:22:2d:80:1f:30 Beacon (MBWCL711) [1.0* 2.0* 5.5* 11.0* 9.0 18.0 36.0 54.0 Mbit] ESS CH: 1, PRIVACY
```

當 Frame Control 為 (1, 0) 時，封包來自 WLAN 外部，WiFi AP 轉傳封包致終端裝置，例如，下載影片或是音樂 (下圖 DS 到 Laptop D)。

```
02:49:32.112375 143187183788us tsft 11.0 Mb/s 2412 MHz 11b -74dBm signal -75dBm signal antenna 0 -81dBm signal antenna 1 DA:33:33:00:00:00:16 BSSID:2c:56:dc:f9:a5:60 SA:14:2d:27:3f:9d:73 Data IV:235 Pad 20 KeyID 1
```

當 Frame Control 為 (0, 1) 時，封包來自 WLAN 網路，目標則在 WLAN 之外，例如，上傳檔案至遠方伺服器 (下圖 Laptop A 到 DS)。

```
00:54:54.441003 136309526943us tsft 2412 MHz 11n -49dBm signal 135.0 Mb/s MCS 7 40 MHz long GI RX-STBC0 -51dBm signal antenna 0 -50dBm signal antenna 1 CF +QoS BSSID:e6:95:6e:4b:3f:14 SA:bc:f6:85:67:29:c5 DA:e4:95:6e:4b:3f:14 Data IV:4db2 Pad 20 KeyID 0
```

當 Frame Control 為 (1, 1) 時，傳收兩端都不在 router 所管理的 LAN 內 (若是 WiFi AP 作為 router，LAN就是 WLAN)，此類的封包都是轉傳 (下圖 AP 0  到 AP 2)，在我們的網路設定下，不會看到此類的封包。

![網路示意圖](/files/-LOrutZLcX66jRUEus5N)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://openwrt-nctu.gitbook.io/project/experiment-overhear/802.11-packet-format.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.