A parks department mesh/bridge capture looks like 'wrong MAC addresses' on data frames until To DS and From DS are considered. What should the analyst do?
Select an answer to reveal the explanation.
Short Explanation
Those 'wrong' MACs are usually just the frame wearing its DS backpack—To DS and From DS tell you which pocket holds SA, DA, BSSID, and transmitter. Read the bit flags first and the parks mesh suddenly makes sense.
Full Explanation
802.11 data frames use To DS and From DS to define how Address 1–4 map among receiver, transmitter, BSSID, SA, and DA. Bridge and mesh paths often use three- or four-address formats that look incorrect if judged by a simple two-address STA model. Expert analysis always interprets address fields in light of those control bits.