I've a very basic understanding of how encryption works.

My knowledge insofar is that of CCNA discovery level on the CISCO courses (along with a few other things such as Steve Gibson and Leo Laporte on "Security Now" in various episodes).

My question(s) is(are):

Would encryption not break the networking concept of source ip/mac destination and MAC address in packets / frames?


Obviously any "unencryption"(keys) data could be sent with the data, but that would break the security, alongside switches being unable to direct data and build their MAC tables on an internal network.

Now i'll make some assumptions on what i know. Either:

  1. Switches can use what's in the packets IP & MAC address's encapsulated header, alongisde the data known from prior connections to unencrypt the packets encapsulated with the source and destination frames MAC address.
  2. Routers can use what's in the packet / prior connections packets data to unencrypt the packets encapsulated with the source and destination IP adresses.
  3. The entire concept of encryption on the internet is unworkable (obviously untrue)
  4. source and destination MACs/ip's are sent unencrypted for encrypted packets. (If this is the case, does this mean that a man-in-the-middle could capture all data, record it, then spend as much time as they please brute forcing keys to unencrypt it?)

Or else, my assumptions ar bogus for some reason (Why are they bogus?).

This question is born of entirely theoretical knowledge from learning these courses, so please go in to as much detail as you absolutely are willing, even if you are thinking you're stating the obvious. I'm asking this out of purely academic reasons/intense curiousity, not because i have a practical problem.

  • They are right. Only the data is encrypted (application layer) and perhaps the transport layer as well (once session has been set up). Link layer encryption works differently (see WPA2 etc or IPsec (?)). If you want to hide your IP and mac addresses you'll have to go through a (trusted) anonymizing proxy, or something. – conspiritech Mar 14 '12 at 12:57

Your assumption #4 is partly correct. Most often in technologies such as SSL/TLS, IP addresses & MAC addresses are sent unencrypted. More specifically, if we look at the OSI Networking Model, IP addresses are part of the of level 3, MAC addresses are part of level two whereas SSL/TLS is at level 4. Most encryption technologies work above level 3 so that the addressing can be read by standard routers and switches.

In order to solve the man in the middle problem encryption technologies have to provide some sort of authentication before starting up and encrypted session. In the SSL/TLS example the use of certificates which are provided by a trusted certificate authority (ie Verisign) is used for authentication.


To go into possibly unwanted detail: Encryption takes place at the transport layer and above, for precisely the reasons of your concern. The transport layer is the one immediately above IP and other addressing schemes. This means that the information required for these protocols is not encrypted, because the data belongs to a lower layer.

For instance, TLS and its predecessor SSL encrypt at the transport layer. This means that the only data that is unencrypted are the IP headers.

Meanwhile, when you choose to encrypt an email in your favorite email program, it will only encrypt the actual email message, while the IP, TCP, and SMTP headers will all be unencrypted. This message, in turn, might be transmitted over a TLS connection. TLS will then encrypt the TCP and SMTP portions, effectively encrypting the message body twice. The unencrypted IP header would then be enough to get it from your computer to the email server. The email server would then decrypt the TLS, allowing it to see that this is a TCP SMTP message. It would then give that to the SMTP program, which would be able to send it to the correct inbox. Once there, the user's email reader would have the information necessary to decrypt the message body.

  • Where would the email packet be unencrypted exactly? Seems to me that if only the IP layer is unencrypted, then once it enters the internal network where the email is destined it wouldn't be able to pass anything but the default gateway router? (as made clear, i'm kind of a noob in this and obviously my guess isn't true, i'm unsure why however) – Dmatig Dec 18 '09 at 20:48
  • I edited my answer above to clarify. Let me know if it helped. – jdmichal Dec 18 '09 at 21:47

Number 4 is true. When an encrypted packet is sent, the data is encrypted, not the source and destination addresses.

Take a look at this SSH login packet:

alt text

It is displayed as an encrypted request packet. As you can see, the source and destination details are visible.

  • Could you take a look at my question in jdmichal's response? I wonder about this too - the MAC address is needed for internal network traversing, is this all handled at the default gateway routers level? If so, how does the packet differentiate between that router and every other hop? – Dmatig Dec 18 '09 at 20:51

WEP and WPA are tags for the question, which are for wireless networks. These protocols handle encryption for the network layer, but they are used to keep people not on the network from being able to see what the network is sending.

Every node on a wireless network must know the encryption key, so that the network's router can decode all traffic. I believe this implies that any node attached to an encrypted wireless network can sniff all the traffic on that network.

So, WEP and WPA do not protect against malicious users who are on the same network as you. You still need to use other layers of encryption to hide your traffic from them.


After reading up on 802.11i (aka WEP2), I see that it uses a separate key for broadcast and multicast packets (Group Temporal Key). Unicast traffic is encrypted using a Pairwise Transient Key, which is a key used for traffic between the base station and one wireless device. WEP also works this way. This means that two wireless devices cannot read each other's traffic since they do not share the same key.

I believe WEP does use one shared key for all the nodes.

In any case, corporate environments often will use VPN technology on top of the wireless link. This added layer of encryption provides security from the wireless device all the way back to the VPN server. Even if the wireless network is sniffed, the VPN packets will still be encrypted.

  • Hmmm. I'm really, really pushing the bounds of what is a legitimate "single question" on SU now... BUT. Lets say i have an entirely internal network. IT uses an ISR (Intergrated Services Router) as a central point (in place of a hub/switch/etc). I know that router provides the encryption. Does that only provide encryption for EXTERNAL traffic? Thanks. – Dmatig Dec 18 '09 at 21:37
  • I do not understand the question. I am not up on my cisco marketing lingo. :) I am going to guess that it has a regular unencrypted network on the internal side, and a VPN link on the external side? If so, then the answer is yes. – Kevin Panko Dec 18 '09 at 21:46
  • That's no problem Kevin. I'm only halfway through the course right now, and my question is very out-of-the box for it besides. I will simplify as best as possible. Lets say you have a "linksys" router connected to your modems ISP. I'm in the UK, i guess it'll work similarly to your countries ISP). On the other side, you have a bunch of clients (lets say 5?). You set up wireless connectivity using some encryption. (I'm deliberetely being vauge. If you do want more specific ideas, lets say something mordern like WPA - I'm just kinda looking for theoretical ideas, not actual examples. – Dmatig Dec 18 '09 at 21:59
  • I hit char limit ^ So i gather that the linksys router would decrypt the information, and therefore my entire internal network (everything behind my standard, linksys home network router) would be free to read everything that is in my home network? I'm a little confused as to how any of this is "secure" in a corporate environment. External links are welcome. – Dmatig Dec 18 '09 at 22:02
  • 1
    A Linksys home router is a network switch, a router with NAT functionality, and a wireless access point, all in the same little box. The job of a network switch is to send Ethernet frames to their destinations based on MAC address. This prevents wired network devices from seeing traffic not addressed to them. Broadcast frames, of course, are sent to every device. Also, frames addressed to a MAC address that the switch does not recognize (it has not seen that MAC before) are also sent to every device. – Kevin Panko Mar 31 '10 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.