Why is this question so confusing? question about mac addresses

Q: What source MAC address would PC1 see when PC2 sends traffic to PC1? )
1. AAAA2. BBBB3. CCCC4. DDDD5. EEEE6. FFFF

took a practice test and this question is so confusing, wouldn't pc1 not see the source mac address because it is not the sender?

please help me understand

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

NetworkVeteran

> wouldn't pc1 not see the source mac address because it is not the sender?

Lookup the fields in an Ethernet frame, on say Wikipedia. Note that the source and destination mac address are always included--as are some other fields which you should study about before taking your exam. Since they are ever-present, the question is really asking what the values will be after a message is sent by PC2, at the point when PC1 actually receives it.

Meditate a bit on the differences between the data-link (Ethernet) and network (IP) layers.

Also, on what effect hubs, switches, and routers have on them!

gbdavidx

doesn't really help explain the answer for me

paul78

The key tip is "differences between the data-link (Ethernet) and network (IP) layers".

A MAC address is an ethernet hardware address. The article on Wikipedia does a good job explaining what a MAC address is - MAC address - Wikipedia, the free encyclopedia

gbdavidx

I get the difference between the two and the MAC address using LLC AND MAC address for layer 2, what i don't get is why it chooses Fastethernet 0/0 and not router 1 or the computer's mac address (pc1) since that's its destination

paul78

I am not quite sure what you are asking. Are you asking why the answer is (2) and not (5),

Try to think of it in chucks - if PC2 is sending data to PC1 - what would the ethernet frame look like? And what would the IP packet look like? What happens when router 2 receives that ethernet frame from PC2 - what would router 2 do with the ethernet frame?

BookFella

gbdavidx wrote: »

what i don't get is why it chooses Fastethernet 0/0 and not router 1 or the computer's mac address (pc1) since that's its destination

It's using the interface mac address because hardware addresses are always local. In this case, the routers are considered "local".

theodoxa

The source and destination MAC Addresses (Layer 2) are changed each time a frame passes through a Layer 2 (Switch) or Layer 3 (Router) interface. They do not change [I believe] when being repeated by a Layer 1 device such as a Hub or Repeater. Basically, while Routers use IP (Layer 3) Addresses to make routing decisions, the actual routing/switching is done on Layer 2 using MAC Addresses. The router will look in its ARP table for an entry for the next-hop IP. If one exists, it changes the destination MAC to the address listed in the table and the source MAC to that of its interface. If an entry does not exist, it will send an ARP Broadcast looking for the device that has that IP Address. The Layer 3 (IP) Source and Destination Addresses do not change in transit, except when using NAT. Think of it this way...the IP Address (Layer 3) is like the address and return address on a letter. When you mail it, each postal center it passes through will use those addresses to determine where to send it (route it) next. They will then forward it to the next postal center along the route. Layer 2 or MAC Addresses would be like the various postal centers. They get it from one interface (postal center) to another.

gbdavidx

thank you i think i get it now

Michael2

PC1 would see the MAC address of the interface that connects it to the router. Routers build tables of IP addresses, so they can determine which interface to use when forwarding a packet. PC's never know any of the MAC addresses outside of their respective networks, so the version of the packet PC1 receives would have the R1 MAC address as the source MAC address. It would then reply with a packet using PC2's IP address but the MAC address of the R1 interface for the destination. R1 would recognize that the destination host is not on its network and send the packet out its serial interface.

I think the confusion lies in the question of how PC2 would know what MAC address to use when sending the initial packet. What happens is that the user enters the destination IP address for R2, PC2 sends an ARP for the matching MAC, R2 says 'send it to me', and PC2 uses the MAC address of the connected R2 interface.

instant000

If you can load up Wireshark and look at a few captures, available here:
http://chrissanders.org/ppa/ppa2ecaptures.zip

It might be useful for clearing up how things really look.

Hope this helps.

gbdavidx

instant000 wrote: »

If you can load up Wireshark and look at a few captures, available here:
http://chrissanders.org/ppa/ppa2ecaptures.zip

It might be useful for clearing up how things really look.

Hope this helps.

thanks for the idea! i will!