2

So I'm having trouble understanding how packets travel from one machine to another. Below I've put in an example of Computer 1 trying to connect to Computer 2.

Computer 1  
IP: 192.168.1.11  
Subnet: 255.255.255.0  
Default Gateway: 192.168.1.1  
MAC: 00:00:00:00:00:aa

Router 1  
IP: 192.168.1.1  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:bb  

Router 2  
IP: 192.168.2.1  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:cc  

Computer 2   
IP: 192.168.2.1  
Subnet: 255.255.255.0  
Default Gateway: 192.168.2.12  
MAC: 00:00:00:00:00:dd

If I connected from Computer 1 to Computer 2 and followed the flow of a packet I believe that the source address from what the information leaves router 2 would be 192.168.1.2 and the source MAC address would be 00:00:00:00:00:cc. From my understanding the destination stays the same but the source will update as it goes through its path. Is this correct or is their something I'm missing?

  • I made an edit to the addresses. I meant to set router 2 to 192.168.2.1 so the default Gateway of Computer 2 was 192.168.2.1. – Joey Jul 24 '14 at 1:50
1

Whew. This is a bit of a tricky one given your scenario.

First off, router 2 shouldn't share an interface with router 1 that is also on their client-side interfaces.

In your example, all 4 devices share the same LAN segment, which as an aside is in the non-routable (edit: across the "Internet") IP address range for the 192.168.x.y family.

A better way would be to think of it as follows:

Computer 1
IP: 192.168.1.100
Subnet: 255.255.255.0
Default Gateway: 192.168.1.1
MAC: 03:00:00:00:00:11

Router 1
IP: 192.168.1.1
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:22
IP: 192.168.12.1
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:33

Router 2
IP: 192.168.12.2
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:44
IP: 192.168.2.1
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:55

Computer 2
IP: 192.168.2.200
Subnet: 255.255.255.0
Default Gateway: 192.168.2.1
MAC: 03:00:00:00:00:66

Ignore the fact that the MAC's lead with a 03 hex character, that's just for correctness for the network snobs out there. [EDIT] I had to amend it to 0x03 for it to be both locally assigned and globally unique.

So what is happening here is: There's a cable from Computer 1 plugged into Router 1. These two share the 192.168.1.x network. There's a cable from Router 1 to Router 2. These share the 192.168.12.x network. There's a cable from Router 2 to Computer 2. These share the 192.168.2.x network.

In your original write-up, all 4 devices would have had to be connected to the same switch in order for it to even work... and in such a case Computer 1 would've talked directly to Computer 2. Note: for you network wizards out there I know you can do static routing to force the original network configuration to work, but that isn't what this User is asking about....

Now on to your specific question.

You are half correct. The MAC address that Computer 2 see's is that of Router 2. In my example that would be MAC 03:00:00:00:00:55. However, the IP address it see's is of Computer 1. That is how Computer 2 can respond back to Computer 1. IP addresses are, theoretically, "universally unique."

The way networks work, given your level of intent of knowledge, is that layer 2 (datalink / MAC-layer - in an all Ethernet/IPv4 environment) addresses change PER HOP. PER HOP is defined as 'transiting any layer-3 processing device'. Router's and computers almost always process layer 3. Switches can process layer 3 but they tend to leave it alone.

So as a message goes from Computer 1 to Computer 2 the flow looks like:

AT HOP 1 - Between Computer 1 and Router 1

SourceIP: 192.168.1.100 (Computer 1)
SourceMAC: 03:00:00:00:00:11 (Computer 1)
DestIP: 192.168.2.200 (Computer 2)
DestMAC: 03:00:00:00:00:22 (Router 1 - Interface facing Computer 1)

AT HOP 2 - Between the routers

SourceIP: 192.168.1.100 (Computer 1)
SourceMAC: 03:00:00:00:00:33 (Router 1 - Interface facing Router 2)
DestIP: 192.168.2.200 (Computer 2)
DestMAC: 03:00:00:00:00:44 (Router 2 - Interface facing Router 1)

AT HOP 3 - Between Router 2 and Computer 2

SourceIP: 192.168.1.100 (Computer 1)
SourceMAC: 03:00:00:00:00:55 (Router 2 - Interface facing Computer 2)
DestIP: 192.168.2.200 (Computer 2)
DestMAC: 03:00:00:00:00:66 (Computer 2)

So you see, the IP address layer (layer 3) addresses stay the same across the entire communication, but the datalink layer (layer 2) addresses change each time another device that processes a layer3 address is involved.

I hope this helps. If it's still confusing feel free to message back and I'll try to explain the specific subset that you're finding challenging.

| improve this answer | |
  • Thanks for your help Nick. So from your example I'm taking it as the Source address will always stay the same but the source MAC will change at each hop. This was something I've been trying to wrap my head around and I think this was exactly what I needed. – Joey Jul 26 '14 at 0:28
1

Your example is flawed. (I saw you edit it, it's still flawed.)

In your example, Router 1 and 2 are on the same subnet (i.e. they have the same subnet mask). So Computer 1 is NOT going to send anything out of the default gateway, it is simply going to throw the packet out of the NIC and expect that a switch or the medium will get it to Computer 2.

Now, if you change Router 2 and Computer 2 to this:

Router 2
IP: 192.168.2.2

and

Computer 2
IP: 192.168.2.12

[edit by nick shown in bold] then Router 2 and Computer 2 will be on (their own separate subnet, NOT:) separate subnets, and the example will begin to make more sense.

However, and since you didn't provide a diagram I'm assuming here, that you want traffic to move this way:

Computer 1 <-> Router 1 <-> Router 2 <-> Computer 2

Router 1 and Router 2 cannot be on the same subnet for this to work. There will actually be a third network between them whereby they trade traffic. (It's also a little weird for a default route to refer to a private network, typically it means "Internet", but certainly possible.)

Here's what I'm surmising you are trying to do, I apologize for the crudeness of the pic: enter image description here

MAC addresses do not propagate beyond routers. Computer 1 wants to send a packet to Computer 2. Computer 2 is not on the same subnet, so computer 1 sends it to the default gateway.

This ends up being a frame sent from Computer 1's MAC to Router 1's MAC.

Routers forward packets, and forwarding means copying out of a different interface. So Router 1 will see that the destination of the packet it got from Computer 1 is destined for Computer 2. (It would have had to be programmed with a static route or use a protocol like RIP/OSPF to know that in a situation like this.)

So then the IP packet now has a source MAC of Router 1's second NIC and a destination MAC of Router 2's first NIC. And so on until it gets to Computer 2.

| improve this answer | |
  • i'm a little rusty.. but giving your post a quick read You write "Now, if you change Router 2 and Computer 2 to this: Router 2 IP: 192.168.2.2 Computer 2 IP: 192.168.2.12 then Router 2 and Computer 2 will be on separate subnets" <-- What? A)I'm not clear what a router on a subnet means 'cos a router has one IP/interface on 1 subnet and another IP/interface on another subnet B)the two IPs you gave in that quote have a mask of 255.255.255.0 in which case they'd be on the same subnet of 192.168.0.0/24 but you said "then Router 2 and Computer 2 will be on separate subnets" ur pic looks good tho – barlop Jul 24 '14 at 2:23
  • A router by definition will have 2 interfaces on 2 separate subnets, if it doesn't, it's not a router and can't route. – LawrenceC Jul 24 '14 at 2:40
  • U wrote in comment "A router by definition will have 2 interfaces on 2 separate subnets, if it doesn't, it's not a router and can't route."I don't deny that.I even said it but Forget 'A' though as I see what is meant by router on a subnet (or subnet on a router). Though A router is on 2+ subnets and 2+ subnets are on a router. I still find part of what you wrote in your post rather strange. You seemed to give two IPs on the same subnet and say they were in different subnets. – barlop Jul 24 '14 at 9:18
  • [ Router 1 + Computer 1 ] is on one subnet (192.168.1.0/24 in the example), and [ Router 2 + Computer 2 ] is on a second subnet (192.168.2.0/24), is what I meant. – LawrenceC Jul 24 '14 at 10:36
0

You are half right, in that the MAC address changes with each hop, but the IP addresses of the connection do not change unless there is NAT/PAT technology inline, or an application proxy is in use.

Note, I believe the address for computer2 should be somthing like 192.168.2.12, rather than 1.12. that would imply that your packet doesn't go through router2 at all. I believe you are looking for somthing like:

Computer 1  
IP: 192.168.1.11  
Subnet: 255.255.255.0  
Default Gateway: 192.168.1.1  
MAC: 00:00:00:00:00:aa

Router 1  
LAN IP: 192.168.1.1  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:bb  

WAN IP: 192.168.3.1  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:b1  

Router 2  
LAN IP: 192.168.2.2  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:cc  

WAN IP: 192.168.3.2  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:c1 

Computer 2   
IP: 192.168.2.12  
Subnet: 255.255.255.0  
Default Gateway: 192.168.2.2  
MAC: 00:00:00:00:00:dd

so we have three networks, the LAN computer1 is in (.1.X), the network between the two routers (.3.X), and the LAN that computer2 is on (.2.X).

MAC addresses are for addressing frames, so they are tied to the implementation of each LAN. you can use the mac address ::aa to send frames around the network Computer1 and Router1 are connected to, but if you tried to send a frame to ::dd on this LAN, it will not reach its destination. So a mac address is only good on the network that bears a device with that MAC.

The IP address however is made to pass between networks, so it remains constant. the packet gets re-encapsulated in a new frame every time it crosses a router, but the IP packet itself remains unchanged. this is important, because if Computer2 in your scenario recieved a packet from 192.168.1.1 with MAC ::cc, it would have no way to tell that it didn't come from the router, and when computer2 responded, router2 would have no idea who it is responding to.

so, the packet that computer2 receives has the source IP 192.168.1.11, but the MAC address ::cc.

NAT/PAT makes this a little more confusing, in that more info is needed to make source/destination decisions, so remember, a scenario with real home routers is a little more completed.

| improve this answer | |
0

Assuming the routers are not doing NAT (Network Address Translation. The source and destination addresses will stay the same at each point on the network. If you only had one router in between the two hosts, the MAC addresses would remain the same. I would expect the same behavior in this case.

The arp program will show you what mac address is expected. On each computer run the command arp -an (or on Windows arp -a. This will display all the known local devices and their mac address. Traffic for remote devices will be routed to the mac address of the gateway.

If the route between the two routers is over the Internet, then the routers will be NAT the source address at each computer will be the Internet IP address of the opposite router, and the mac address of local router. In this case, you will not be able to open a connection between the computers using the addresses listed. You would need to connect to the Internet IP address of the router at the other end, and it would need to know to NAT the address to the desired computer.

If you have an established connection (ssh works well), then you can use the netstat -nat command (or on Windows the netstat command) to list all the connections. You can filter or scan the list to find the address of the connection. On Linux using ssh, the command who am i will list the remote address you connected from.

| improve this answer | |
0

OUCH. A router won't have just have one IP. I suggest 'networking first step' by wendell odom.

You write "From my understanding the destination stays the same but the source will update as it goes through its path."

It's not clear what you're talking about. You haven't written much and the little that you've written has been ambiguous. If you cannot write clearly then you're not going to understand clearly.

Don't just say "the source" "the destination". Say specifically if you mean Source IP address or Source MAC address or Dest IP address or Dest MAC address.

The source and dest IP will stay the same. (unless there was NAT or something very unusual, and you don't have that)

The MAC addresses(source and dest) can change. Routers rewrite MAC addresses. Though your Routers aren't really set up right. See ultra's pic for how a Router has multiple NICs each with its own IP on its own subnet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.