Why if I am connected via WiFi and send a packet to another device in the same WiFi, the dest MAC in link layer is not the AP's?

asked 2021-12-31 08:39:46 +0000

allexj
1 ●1

In IEEE 802.11 protocol, in the link frame, the second address is the sender mac address, and the first address is the receiver mac address, which is the AP address if the sender is a station, and the destination station if the sender is the AP.

So in my case, since I am sniffing the packets with Wireshark from my perspective, if I send ICMP for example, I should see my mac as the second address, and the AP mac as the first address.

But:

The Src address is my machine. The Dst address is my phone, which is the device I was giving the ICMP packets to. The same thing in reverse in the response packet.

Also the link layer shows as "Ethernet", but I am connected via wifi, so it should appear IEEE 802.11, but I have seen here that wifi interfaces often present themselves as Ethernet interfaces, so they present Ethernet translated packets, to make it easy for the OS to manage them, or something like that...

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2021-12-31 09:38:37 +0000

Jaap

13742 ●710 ●115

That's what Monitor mode in the capture options is for.

edit flag offensive delete link

Comments

ok thx x

allexj ( 2022-01-02 21:11:35 +0000 )edit

add a comment

answered 2022-01-01 19:48:51 +0000

Guy Harris
19890 ●3 ●659 ●207

Also the link layer shows as "Ethernet", but I am connected via wifi, so it should appear IEEE 802.11, but I have seen here that wifi interfaces often present themselves as Ethernet interfaces, so they present Ethernet translated packets, to make it easy for the OS to manage them, or something like that...

Yes.

So, unless, as Jaap suggests, you capture in monitor mode, that's what the interface and its driver will do. You won't see 802.11 headers, which means you won't see the "receiver address" or "transmitter address"; if a frame is transmitted from a station with the MAC address XX:XX:XX:XX:XX:XX to a station with the MAC address YY:YY:YY:YY:YY:YY, the source address will be XX:XX:XX:XX:XX:XX and the destination address will be YY:YY:YY:YY:YY:YY, even though the frame may initially be sent to an AP with the MAC address ZZ:ZZ:ZZ:ZZ:ZZ:ZZ - ZZ:ZZ:ZZ:ZZ:ZZ:ZZ will be the "receiver address" of the frame, but YY:YY:YY:YY:YY will be the destination address of the frame.

edit flag offensive delete link

Comments

thanks !

allexj ( 2022-01-02 21:11:30 +0000 )edit

add a comment