A frame may have up to 4 Addresses which depends on the ToDS and FromDS bits in the Control Field as mentioned below:
Address1: is Recipient Address, like BSS station is the immediate recipient of the packet. If ToDs is set then this is AP address and if ToDs is not set then this is address of the end station.
Address2: is Transmitter address ( station which is physically transmitting the packet). If FromDS is set then this is AP address else it is the station address.
Address3: is mostly the remaining, missing address. If FromDS is set to 1 then this is the original source Address and if the frame has ToDS set then this is destination Address.
Address4: is in some cases when a Wireless Distribution System is used and fram is being transmitted from one AP to another. In such cases, both the ToDS and FromDS are set, so both the original destination and the original Source Addresses are missing
Following table describe the usage of addresses according to ToDS and FromDS:
| ToDS | FromDS | Address 1 | Address 2 | Address 3 | Address 4 |
| 0 | 0 | DA | SA | BSSID | N/A |
| 0 | 1 | DA | BSSID | SA | N/A |
| 1 | 0 | BSSID | SA | DA | N/A |
| 1 | 1 | RA | TA | DA | SA |
BSSID: BSS Identifier is the MAC address of AP, which uniquely identifies each BSS. BSSID is randomly generated, locally administered MAC address of the STA that initiated the IBSS.
DA (Destination Address): DA indicates is the MAC address of the final destination to receive the frame.
SA (Source Address): SA indicates the MAC address of the original source that initially created and transmitted the frame.
RA (Receiver Address): RA indicates the MAC address of next immediate STA on wireless medium to receive the frame.
TA (Transmitter Address): TA shows the MAC address of the STA that transmitted the frame on to the wireless medium.