The To DS and From DS Fields

Currently I’m studying for the Certified Wireless Analysis Professional (CWAP) exam and I’m rereading the study guide and I found the chapters that examined the different fields and elements present in the MAC header most interesting. I had a rough idea, but during my studies learned a great deal more about the unique fields and elements dedicated to wireless that keep the network functioning and help packets get delivered. Two fields of particular interest are the To Distribution System (To DS) and From Distribution System (From DS) and how these fields determine if the frame is leaving or entering the wireless environment.

Distribution System

Just a quick definition of the distribution system and basically the DS is the infrastructure that connects multiple access points together to form an Extended Service Set (ESS). The DS is typically an 802.3 Ethernet wired network, but it doesn’t have to be, and the DS can even be a wireless back haul.

MAC Header & Frame Control Field

Lets now look at the MAC header which can contain four address fields. The number of address fields is a major difference between Ethernet frames, which only use two address fields, and wireless frames that could use as many as four address fields. Each address field is 6 bytes in length to hold a standard 48 bit MAC address, and most wireless frames will only use three of the address fields, and wireless frames being transmitted in a wireless distribution system would be the only frames using all four address fields.

The MAC header contains the Frame Control Field consisting of 11 sub fields (see pic below) including the To DS and From DS fields. The To DS and From DS fields are each 1 bit and can be occupied with a 1 or a 0 and there are four possible combinations using these two fields.

MAC Header

The To DS and From DS fields are important for assessing the packet since the bit combination of these fields identifies if the frame is entering or leaving the wireless environment. The fields can also show if the packet is part of an ad hoc network, or part of a wireless distribution system, and if the frame is a Management or Control frame not intended to leave the wireless environment.

To DS and From DS fields are both 0

The frame is either part of an ad-hoc network or the frame is not intended to leave the wireless environment. The screen shot below shows a Beacon Management frame with a status of not leaving the DS or network (see the highlighted line). Management and Control frames will always have the To DS and From DS fields set to 0 and are never sent to the distribution system network.

An Ad-hoc network connects multiple wireless devices together, and typically does not connect to a wired network, so there is no DS involved or requirement to have the fields set to 1.

beacon

To DS field is 1 and From DS field is 0

The frame is leaving the wireless environment and is intended for a computer on the distribution system network. For example after a wireless station authenticates it will need to obtain an IP address and that request will be forwarded by the AP to the DHCP server that resides on the distribution system network.

To DS field is 0 and From DS field is 1

The packet is entering the wireless environment coming from the DS. The screen shot below shows a Data (Type/Subtype field) frame capture in Wireshark, and the highlighted line shows the To DS and From DS fields along with a status of the frame coming from the DS to the station via the access point.

datatods0fromds1

To DS and From DS fields are both 1

When both the To DS and From DS are set to 1 the packet is involved with a wireless distribution system (WDS) network. WDS networks are used to connect multiple networks together, typically for building-to-building connectivity, or a WDS can connect access points together to from a wireless mesh network.

Address Fields

As mentioned the MAC header can contain four addresses and these addresses can change depending on how the To DS and From DS fields are set. Here is quick reference for how the address fields are set for each To DS and From DS combination.

To DS and From DS are both 0

Address 1 = Destination
Address 2 = Source
Address 3 = BSSID

To DS field is 1 and From DS field is 0

Address 1 = BSSID
Address 2 = Source
Address 3 = Destination

To DS field is 0 and From DS field is 1

Address 1 = Destination
Address 2 = BSSID
Address 3 = Source

To DS and From DS are both 1

Address 1 = Receiver
Address 2 = Transmitter
Address 3 = Destination
Address 4 = Source

 Conclusion

When observing packets in a sniffer or pen testing a wireless network It is important to look at the To DS and From DS fields to verify the direction of flow for the packet and how these fields then relate to the MAC addresses in the header.

Advertisements

CWNA CWSP CWAP Study Resources

General Resources

802dot11logoQuick overview of 802 legacy, 802.11a, 802.11b, 802.11g, 802.11n, and the 802.11ac draft standard.

Free Wi-Fi Learning Resources from CWNP

The CWNP Question of the Day (QOTD)

CWNP Exam Terms

CWNP Study Guide CD-ROM Downloads

Packetlife WLAN cheat sheet

Wi-Fi Alliance home page

CWNA

Certified Wireless Network Administrator (CWNA) Overview of the Certificfation

CWNA Certified Wireless Network Official Study Guide: Exam PW0-105 (CWNP Official Study Guides)

Here is the link to download the updated PW0-105 CWNA exam objectives

24GHz_channels

5ghzuniibandschannels.jpg

Wi-Fi Back to Basics – 2.4 GHz Channel Planning

Wikipedia page on  WLAN Channels

802.11 Medium Access

Introduction to Wi-Fi Wireless Antennas

Wi-Fi CERTIFIED™ for WMM®-Power Save

Aerohive’s Medium Contention & Mac Sublayer WiFi 101 video (28:00)

Easy db Math in 5 Minutes

Radio Frequency Measurements (1:13)

Understanding IEEE 802.11n

Memorize 802.11 MCS values and Data rates for CWNA or CWDP (YouTube Video)

CWSP

CWSP Certified Wireless Security Professional Official Study Guide: Exam PW0-204 (CWSP Official Study Guides)

Here is the link to download the updated PW0-204 CWSP exam objectives

EAP Types (Excel file for my own reference)

Marcus Burton, Director of Product Development at CWNP, teaches you the 802.11 4-way handshake. (YouTube Video)

Authentication & Key Management (Marcus Burton, CWNP)

CWSP-802.11r Over-the-Air FT

White Paper (PDF download) Robust Secure Network Fast BSS Transition

White Paper (PDF download) 802.11i Authentication and Key Management

User Guide for the Cisco Secure Access Control System 5.2 (good extra reading on different flavors of EAP)

George Stefanick – CWSP Journey Chapter 5 – RSN

George Stefanick – CWSP Journey Chapter 4 – EAP, EAP, EAP, and EAP

EAP-TLS and PEAP: what they are, part 1 (YouTube Video)

EAP-TLS and PEAP: what they are, part 2 (YouTube Video)

CWAP

CWAP Certified Wireless Analysis Professional Official Study Guide

CWAP Exam Objectives (PDF)

WIRELESS LAN SECURITY MEGAPRIMER PART 5:DISSECTING WLAN HEADERS

802.11 Beacons Revealed

802.11 Beacon Intervals – The Real Story

What is QAM?

CWAP – MAC Header : Frame Control

Understanding Wi-Fi Carrier Sense (Revolution Wi-Fi)

802.11 PPDU Formats

CWAP Study Guide Errata

Extras

My CWNA/CWSP/CWAP YouTube Channel

How I Studied to Pass the CNWA Certification Exam

WiFI Kiwi’s Blog – CWSP Passed!