This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

what is (RA) & (TA) means?

0

Hi There,

I have some questions:

  1. In my wireshare result, the source column sometimes showing (TA) and destination (RA). are these means Transmission Address and Recipient Address?

  2. I did a tcpdump with limit -s 60, and the source column come out blank. But when I did not set any limit the some source line showed MAC address (TA) and some line are showing blank. Can anyone help me explain to me why?

asked 20 Oct '13, 12:25

Billy's gravatar image

Billy
11112
accept rate: 0%


One Answer:

0

The only source file where I found those two strings is packet-ieee80211.c.

If you search that file for "RA" and "TA" you'll see that those stings are added to the source and destination address if it is a wlan/wifi control frame.

You can see that in the following capture files as well:

http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=Http.cap (Frames: 2,6,10,etc.)
http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=mesh.pcap (Frames: 129,132,136)

are these means Transmission Address and Recipient Address?

yes.

I did a tcpdump with limit -s 60, and the source column come out blank.

As you did not give any information about the interface you were capturing on (and how - monitor mode:yes/no), I can only speculate. I guess you simply did not capture enough bytes of the frame to show the src/dst addresses.

Regards
Kurt

answered 21 Oct '13, 03:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%