In an ESS, if a frame is being sent from a station in one BSS to a station in another BSS then that frame will cross the DS from one AP to another.
When the frame leaves the sending station the To DS bit will be set and the address 1 field will be the MAC of that station's AP. The address 2 field will be the MAC of the send station and the address 3 field will be the MAC of the destination station in the other BSS.
The frame will then cross the wired network from one AP to the other.
Now when the frame leaves the AP in the destination BSS the From DS bit will be set and the address 1 field will be the MAC of destination station. The address 2 field will be the MAC of this AP and the address 3 field will be the MAC of the sending station in the other BSS.
If any of this is incorrect please set me straight.
My question is when the frame is sent across the DS from the sender's AP to the receiver's AP what MAC addresses are used in the Etherent II frame? Since it's not an 802.11 frame, we have only a source and destination address not four address fields.
My follow-up question is when the sender's AP receives the frame from the sending station how does it know to send it to the receiver's AP? In other words, how does it know that it's a station in a BSS and not a wired station (assuming the wired station was in the same broadcast domain)?