If I have a host that is sending a packet to a host on a remote network, when the packet crosses a router and the source MAC is stripped, which MAC is placed in the frame? Is it the receiving interface's MAC or is it the forwarding interface's MAC? I thought it was the forwarding interface's MAC but I got a question on the exam prep I am using that seems to say otherwise.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations derfloh on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
MAC address question
- Thread starter frelaxx
- Start date
CiscoGuy33
Instructor
frelaxx,
As the layer 2 frame is being "rebuilt" to encapsulate the layer 3 packet it will have the MAC address (or any other layer 2 address being used based on the protocol of the interface it is being sent out over) of the next hop in the "to" or destination area of the frame and it will have it's MAC address as the "from" or the source address.
IP addresses (layer 3) are used end to end, MAC addresses (layer 2) are used between each "hop" and stripped off as it is sent to another destination.
The above does not take NAT into consideration where the IP address would be changed as it is NATed.
Think of it as an inter office memo - it is put in an envelope with a desk location on it (packet) the mail room puts it in a Fedex overnight package (frame) and it is sent to next office (router) that router/office opens the Fedex package and throws it away and then if it needs to send the packet/memo to another office/router it must put it in another Fedex package (with that address) and sent out!
They might change protocols and send it UPS in which case it will have to be in a UPS package (frame) such as a message going from a LAN to a WAN.
Hope this helps!
E.A. Broda
CCNA, CCDA, CCAI, Network +
As the layer 2 frame is being "rebuilt" to encapsulate the layer 3 packet it will have the MAC address (or any other layer 2 address being used based on the protocol of the interface it is being sent out over) of the next hop in the "to" or destination area of the frame and it will have it's MAC address as the "from" or the source address.
IP addresses (layer 3) are used end to end, MAC addresses (layer 2) are used between each "hop" and stripped off as it is sent to another destination.
The above does not take NAT into consideration where the IP address would be changed as it is NATed.
Think of it as an inter office memo - it is put in an envelope with a desk location on it (packet) the mail room puts it in a Fedex overnight package (frame) and it is sent to next office (router) that router/office opens the Fedex package and throws it away and then if it needs to send the packet/memo to another office/router it must put it in another Fedex package (with that address) and sent out!
They might change protocols and send it UPS in which case it will have to be in a UPS package (frame) such as a message going from a LAN to a WAN.
Hope this helps!
E.A. Broda
CCNA, CCDA, CCAI, Network +
- Thread starter
- #3
CiscoGuy
I understand the premise of why the MAC is stripped off, what I really want to understand is which MAC is then used to replace the original source MAC. Is it the MAC of the receiving interface or is it the MAC of the forwarding interface?
Thank you for you assistance.
I understand the premise of why the MAC is stripped off, what I really want to understand is which MAC is then used to replace the original source MAC. Is it the MAC of the receiving interface or is it the MAC of the forwarding interface?
Thank you for you assistance.
CiscoGuy33
Instructor
frelaxx,
The "new" frame will have 2 MAC addresses -
Destination - the MAC address of the next hop
Source - the MAC address of the interface that the frame is being sent out.
If the router has only 1 Ethernet interface the "new" frame would have the previous "destination" MAC in the source address area and the new destination MAC will be the next router down the line.
Hope this help!
E.A. Broda
CCNA, CCDA, CCAI, Network +
The "new" frame will have 2 MAC addresses -
Destination - the MAC address of the next hop
Source - the MAC address of the interface that the frame is being sent out.
If the router has only 1 Ethernet interface the "new" frame would have the previous "destination" MAC in the source address area and the new destination MAC will be the next router down the line.
Hope this help!
E.A. Broda
CCNA, CCDA, CCAI, Network +
Look at it like this.
Your traffic enters and then leaves an interface.
When it enters an interface it has its last address as source.
When it leaves the interface, its last address (source) has changed. It is now the address of interface it is leaving.
All interfaces on a device have a mac address, so if traffic is switched to a different interface on the same device, it will still act the same as above, as if it were an interface on a separate device.
Your traffic enters and then leaves an interface.
When it enters an interface it has its last address as source.
When it leaves the interface, its last address (source) has changed. It is now the address of interface it is leaving.
All interfaces on a device have a mac address, so if traffic is switched to a different interface on the same device, it will still act the same as above, as if it were an interface on a separate device.
norteldude78
IS-IT--Management
If the router has only 1 Ethernet interface the "new" frame would have the previous "destination" MAC in the source address area and the new destination MAC will be the next router down the line. "
hey, CiscoGuy33: Que????
maybe im just smokin...but why would the previous destination MAC be in the source address area? And what does 1 ethernet interface have to do with it?
hey, CiscoGuy33: Que????
maybe im just smokin...but why would the previous destination MAC be in the source address area? And what does 1 ethernet interface have to do with it?
norteldude78,
How about these situations:
1. Router on a Stick using subinterfaces
2. Policy routing in and out the same interface
3. NAT on a stick
4. Multiple IP subnets on the same Ethernet interface using secondary IP addresses for each subnet.
5. Multiple IP subnets on the same Ethernet interface because someone fatfingered the subnet mask.
My 2 cents.
How about these situations:
1. Router on a Stick using subinterfaces
2. Policy routing in and out the same interface
3. NAT on a stick
4. Multiple IP subnets on the same Ethernet interface using secondary IP addresses for each subnet.
5. Multiple IP subnets on the same Ethernet interface because someone fatfingered the subnet mask.
My 2 cents.
In other words, the frame can be sent out the same interface it came in on in the scenarios Cluebird suggested---what other MAC address could possibly be as the source and destination? The source MUST be the last destination in this case since it is the SAME interface. That is what CiscoGuy and Cluebird mean. If I'm wrong, believe me---I will hear about it in about 2 minutes.
Burt
Burt
CiscoGuy33
Instructor
Thanks Burt and Cluebird!
We tend to think that it comes in on Ethermet 0 and goes out Ethernet 1 or vice versa! I wanted to point out that (as Cluebird listed) it could be just 1 interface.
The key is that the MAC address or in that matter the layer 2 addresses in the frame are local since the frame is stripped off at each hop and the packet is "repackaged" in a "new" frame based on the interface that is "picked" (best route) to be sent out on.
Just as mail (should have) has a "to" and "from" address - so does the frame - destination and source.
E.A. Broda
CCNA, CCDA, CCAI, Network +
We tend to think that it comes in on Ethermet 0 and goes out Ethernet 1 or vice versa! I wanted to point out that (as Cluebird listed) it could be just 1 interface.
The key is that the MAC address or in that matter the layer 2 addresses in the frame are local since the frame is stripped off at each hop and the packet is "repackaged" in a "new" frame based on the interface that is "picked" (best route) to be sent out on.
Just as mail (should have) has a "to" and "from" address - so does the frame - destination and source.
E.A. Broda
CCNA, CCDA, CCAI, Network +
- Status
Similar threads