 | 1 | initial version |
sending something to itself as the Source Address and Destination Address are both the same MAC address
Unlikely. The radio would not put it in the air - just like when you ping your own IP address, it doesn't hit the wire. What we do see is this is a FromDS frame, so actually transmitted by the AP, not the wireless client / Ring device. What this could be is group traffic - multicast or broadcast, and then the AP (also know as the DS) is converting group traffic to unicast (often called multicast-to-unicast conversion, but usually works for broadcast, too, when enabled). So an interpretation is this Ring device sends a group frame to the AP (find the ToDS frame if you can that has a group destination), the AP gets it and then sends it back out over the air so wireless clients can see it, but unicasts it this time. So the source stays the same but the destination is translated to a unicast MAC, one frame for each wireless client.
With limited information provided in the picture, this only offers a possible explanation of what we see. Closer examination of the capture file can either rule this explanation in or out. Its very unlikely, but possible, you have other things going on like duplicate MAC addresses, you are doing traffic injection arbitrarily setting MAC addresses, and other unusual edge cases.
