source ip address and mac address

I am having trouble understanding this: Let's say a packet is sent from pc1 to pc3. How do I figure out what source ip address and mac adress it will have when it reach's host 3. Anyone have a good site that explains this?

http://img61.imageshack.us/my.php?image=examplelx4.png

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

james_

Firstly, think of the switches as being transparent, ie they will only forward or filter frames out of the relevant ports, they will not alter the MAC addresses or IP addresses...

PC1 will build an IP packet with the destination IP address of PC4 and source address of PC1. Another simple one, the Source and Destination IP addresses will not change through the course of the entire routing process.

MAC addresses will change. PC1 knows to send the packet to its local router (default gateway) as it is not in the same subnet as PC4. So it encapsulates the packet into an ethernet frame with source MAC of PC1, Destination MAC of Router 1, because this is where the frame has to be sent to exit out of the .20 subnet. If PC1 does not know the MAC address of Router 1, it will use an ARP broadcast to find out.

When Router 1 receives the frame, it copies from the inbound buffer into I believe RAM on the router, checks the FCS, checks the protocol, strips the ethernet frame, and reframes using an HDLC, PPP header - whatever protocol is being used on the point-to-point connection via the routers, and pops it out on the outbound buffer for delivery. BUT it reframes using its own MAC address as the source MAC, and Router 2's MAC address as the destination MAC. It discards the original ethernet header and trailer from PC1. The router knows to send the packet to router 2, because in its routing table, network 192.168.30.0 is accessed via Router 2.

Same process when Router 2 receives the frame, checks FCS, strips frame, reframes using an Ethernet header and trailer. Source MAC: Router 2, Destination MAC: PC3. IP addresses still haven't been touched.

Hope this helps, CISCO Press INTRO does a good job of explaining the process, page 134, but omits to mention switches, which in general dont do anything with MAC addresses, unless it is trunking between switches using ISL, but even then it encapsulates the entire ethernet frame, it does not discard it.

romain

To be simple, the ip address will never be modified but the mac address will by each equipement who threat the packet. (pc1, switch Ethernet port X, router1 S0 router2 E0, switch port X and pc3)
The mac-address will always be the mac address of the packet's originator.

onddav31

thanks romain, so pc3 will recieve the mac address of the switch 2?

hedhrts

onddav31 wrote:

thanks romain, so pc3 will recieve the mac address of the switch 2?

I disagree. I think james_ is correct. pc3 will recieve a frame with a source mac address of router 2 (the physical interface closest to pc3).

james_

Thanks hedhrts. Hope you recovered from your slip!

Remember, unless we are talking layer 3 or multilayer switches, they will not mess with the MAC address, just forward or filter based on the frame they receive. There is no indication on the network diagram that these are anything more than standard layer 2 switches.

A similar question was posted before:
http://www.techexams.net/forums/viewtopic.php?p=81898#81898

Pash

I have that book james and thats a good explanation I think, I just read it myself (to clarify) after looking at a question very simular to the original poster, however switches were not present on my question.

My summary is simple:

1. Source IP and Destination IP never change during the routing process, just remember layer 3 doesnt change end to end.

2. Layer 2 addresses (MAC addresses) change as the packets cross broadcast domains.

3. When the routers process the packets:- they see the layer 2 address is for them, so they open the packet and look at the layer 3 headers, as these are the chaps they are familular with, using blah blah routing protocol they decide which interface to go out from next, so they build the packet up again (layer 3 info not changing). And send packets out on the wire to the next hop destination.

It's important to remember that the second router will know after reading the IP Data type that the ethernet port is the next route for the frame (from the routing table info). So it will get ready to build the frame back up with ethernet header and trailer, but before it does this it may need to do a ARP broadcast to find the destination host's MAC address, unless this info is already in the routers arp cache.

4. Serial interfaces DO NOT have MAC addresses. The serial link router to router just needs to use the same encap method (HDLC or PPP), as well as the foundations of creating a ptp line (CSU, DSU etc).

So in my understanding the destination MAC address changes ONCE (exluding any ack etc) in this routing operation as does the source. However something Im not entirely sure on is if the MAC address of the first router will pass to the second router?

james_

Hey Pash! Thanks for making me think this over! Of course you are right. P2P links don't require a Source/Destination Address as there is only 1 device on each end of the link!

phucdull

Thanks James, you gave me (or even other people) a good explanation of frames which traveled through routers. Thanks