A frame may have up to 4 Addresses which depends on the ToDS and FromDS bits in the Control Field as mentioned below:

Address1: is Recipient Address, like BSS station is the immediate recipient of the packet. If ToDs is set then this is AP address and if ToDs is not set then this is address of the end station. Continue reading →