36

There is an argument within my office about how smart/efficient the network we have set up really is.

We have a fibre line and a cable line running into a load balancing router, which has a hardware firewall, which lastly has a 64 port switch connected to it.

Each of our workstations are connected to the switch (about 30 machines) plus a NAS and a couple of internal test servers (all assigned 192.168.0.x addresses).

If workstation A wants to communicate with workstation B, is our network smart enough to go:

A → Switch → B and only travel via the first most common connection,

or would the path be A → Switch → Firewall → Router → Firewall → Switch → B and have to go that full route every time?

  • 86
    No smarter than the person who set it up. – Moab Apr 24 '16 at 22:22
  • 5
    hub - useless; router - dumb hardware; switch - smart hardware – Raystafarian Apr 25 '16 at 18:18
73

Routers aren't necessary unless your traffic needs to move to a different subnet. When a computer wants to send some IP traffic to a different machine on its subnet, it needs the recipient's MAC address, since IP addresses aren't a thing at a switch's layer (Layer 2 of the OSI model). If it doesn't know the MAC address, it broadcasts an ARP request, saying "hey, whoever has this IP address, could you tell me your MAC address please?" When the machine gets a response, that address is then attached to the packet, and the switch uses it to send the packet out the right physical port.

When the destination isn't on the same subnet, routers need to get involved. The sender gives the packet to the appropriate router (usually the default gateway, unless you have special routing needs), which sends it through the network to the intended recipient. Unlike switches, routers know about and have IP addresses, but they also have MAC addresses, and that's the MAC address that initially gets put on packets that need routing. (MAC addresses never leave the subnet.)

You can see router IP addresses in the Gateway column of the output of route print on Windows. Destinations that don't require routing have On-link there.

  • 12
    +1 for being right. I add this for even more/further clarity: If the packet must be routed to a different subnet (so it must go to the router), then the system still sends the frame to a MAC-48 address. It just sends it to the MAC-48 address of the router instead of the final recipient. So, either way, the frame will be delivered using a MAC-48 address. The switch will basically ignore the IP address, and just look at what MAC address is needed. – TOOGAM Apr 25 '16 at 5:52
  • 1
    Accepted for not only answering the question, but also explaining why and how. Thank you – bizzehdee Apr 26 '16 at 16:27
29

If 2 computers are connected to the same vlan on a switch and share the same subnet mask - the switch should deliver the packet without hitting your firewall or router.

You can verify this by running tracert 192.168.0.X (assuming Windows) and you should see a direct route to that system.

  • 15
    Or traceroute on Debian or nc on assorted Unicies. – cat Apr 25 '16 at 12:01
19

Almost certainly, the communication path would be A ↔︎ switch ↔︎ B, not going through the firewall and router. Assuming that workstations A and B have IP addresses with the same network and netmask, they should be able to interact with no router involved, because the switch knows how to forward packets. You should be able to verify that there are no intermediate hops between A and B by running traceroute ip_address_of_B from a command prompt on A. (On Windows, the command would be tracert instead of traceroute.)

That said, alternative scenarios are possible, but less likely.

In the old days, before Ethernet switches were prevalent, there were Ethernet hubs. Hubs work the same way, except that they would unintelligently duplicate and forward incoming Ethernet packets out through every single port of the hub, instead of out of the appropriate port as a switch would. If you had a hub instead of a switch, then the router would see (and ignore) all traffic between A and B. Of course, such indiscriminate packet forwarding creates a lot of unnecessary traffic, and Ethernet hubs are uncommon these days.

Another possible (but unlikely) scenario is that the switch could be configured to do port isolation. That would force each workstation's traffic to go through the router. You might want to do that if you considered the workstations to be hostile to each other — for example, ports at a public library or in separate hotel rooms — and you don't want them to be able to directly communicate at all. In an office environment, though, it's very unlikely that your network administrator has set it up that way.

To answer your question in layman's terms: the network should naturally do the "right thing" in your case. However, it could be deliberately reconfigured to do a different "right thing". As a corollary to that, it could also be accidentally misconfigured to do a dumb thing.

0

The other answers are correct. So in the interests of confirmation - I suggest you try it and find out.

tracert or traceroute or tracepath or mtr from one host to another.

Grab a spare (ie non-production) computer and give it an IP of 192.168.166.x /24 or 255.255.255.0 and a gateway of 192.168.166.1

You'll need to configure your firewall device to have a secondary IP of 192.168.166.1 /24 on the same interface as your LAN. Be careful to not break your LAN production traffic at this time. Exactly how you do this depends on your firewall OS.

There's a chance you may need to tweak or extend firewall rules for the LAN interface as well.

The path should be 166machine-switch-firewall-switch-0machine (but you won't see the switch in the traceroute because ethernet switches are at layer2 and traceroute is ICMP at layer3.

Do note, this is called an "overlay" network, and provides no added security. It is not a DMZ, there is no isolation, and does not hide the 166 network from the 0 network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.