2

According to this answer, routers can conceal multiple devices before an ISP and make it look as if there is only one device (the router), with one mac address (just only the router's mac address!) receiving internet service.

But, is this necessarily a requirement of routers? Does DHCP/NAT imply (or necessitate) concealment of mac addresses? (i.e., of devices wirelessly connected to the router)

For example, while I understand routers will appear to have "one IP" (per interface, but regardless!) as far as an isp or modem is concerned, I don't see why they can't simply just copy the exact mac addresses of connected devices' into their ethernet packets. It seems it would make the router's job even easier since the packets/frames coming from the internet to its (router) IP address would already have the exact mac address of the device of interest specified right away!

2 Answers 2

5

But, is this necessarily a requirement of routers? Does DHCP/NAT imply (or necessitate) concealment of mac addresses? (i.e., of devices wirelessly connected to the router)

First of all, neither DHCP nor NAT are a requirement of routers... and on the opposite side, providing a wireless connection does not require a router.

But besides that – yes, "routers" are devices which handle IP packets without the MAC wrapping. Once the packet is delivered to the router, it throws away the original MAC address and makes the routing decision entirely based on what's in the IP packet, and re-sends the packet with a new MAC header apropriate for the output interface.

This means a router can connect networks which have different kinds of MAC addresses (i.e. not just Ethernet's usual 48-bit). It can even connect networks which don't have MAC addresses, such as ADSL circuits or 3G/4G mobile connections, so long as they speak IP.

It seems it would make the router's job even easier since the packets/frames coming from the internet to its (router) IP address would already have the exact mac address of the device of interest specified right away!

Not really; this would just mean the sender – the second router that's a hop away – would need to know the MAC addresses of your devices instead. That means your router would have to pass through the ARP queries, i.e. it'd still do pretty much the same amount of work it's already doing.

So it would merely shift the work elsewhere, as the second router would be doing basically the same thing as your router does now (ARP queries to learn the MAC addresses), except instead of remembering 1 MAC per customer, now it would need to remember 5 or 10 per customer. The same goes for any L2 switches in between, which do not have infinite memory.

Additionally: MAC addresses aren't always globally unique. They have to be unique on the L2 network, but it's possible for the same MAC address to exist on multiple networks, whether it's due to accidental collisions, or due to special protocols (VRRP "high availability"), or due to some customers being intentionally malicious. Of course, it's possible that even the routers' MAC addresses could collide in some cases, but I suspect that's easier to resolve than end-user devices.

(That's also disregarding issues such as networks which don't use the same kind of MAC header, like 4G.)

But most importantly, this is a router. Its actual job is to decide which device receives which packets based on the IP addresses, according to its routing table (and its conntrack state table if NAT is enabled). So technically you could have a device which works entirely at MAC level, including even NAT, but it literally wouldn't be a "router" anymore.

4
  • Interesting! As an occasional user of xfinitywifi wireless hotspots, my ISP actually knows and records the exact mac addresses of all my connected devices. With their network of hotspots all across the US (hotspots.wifi.xfinity.com), it seems they have a pretty big infrastructure (and lot of memory) to do this kind of mac-address-level tracking & switching of user devices on a large scale!
    – ManRow
    Dec 16, 2019 at 10:16
  • Of course, due to the possibility of mac collisions, I doubt Xfinity actually uses mac addresses to necessarily "route" anything upstream of a single hotspot's L2 network. Instead, I'm guessing the mac addresses are merely used for authentication then; however, due to potential collisions among subscribers, I doubt this would be a secure means of even doing authentication in that case either! security.stackexchange.com/questions/222589/…
    – ManRow
    Dec 16, 2019 at 10:16
  • 2
    Xfinity probably doesn't use a country-wide L2 network though. Probably each hotspot is a separate L2 network with a small list of currently active MACs, and the central database of MAC addresses only needs to be consulted for authentication (i.e. when accepting or rejecting a new device). Dec 16, 2019 at 10:21
  • 2
    (Although it is possible that with technology like SPB or TRILL they could use a giant L2 network, I think these protocols could scale to that level... but not on cheap hotspots. And they still wouldn't scale to the entire Internet.) Dec 16, 2019 at 10:23
2

MAC Addresses are point to point addresses. As such every device that splits the broadcast domain "hides" mac addresses. Ethernet is a layer two protocol.

You can't do much with a MAC adress unless you have a direct connection to the device that owns the address or share the same device that splits the broadcast domain.

For a more thorough explanation see: What is the exact use of a MAC address?

2
  • 2
    That would be correct for the broadcast domain, but not for the collision domain. Ethernet switches divide the collision domain but do not hide MAC addresses – they do not change the MAC header at all. Dec 16, 2019 at 9:11
  • Damn it, I mixed them up again. Sorry, you're correct. Fixed.
    – Seth
    Dec 16, 2019 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .