All language subtitles for 20. How does a router forward traffic

So that being said, how would traffic flow if device A sends traffic to device C?

So let�s say for example that device A pings device C.

So on host A or device A the command ping 10.1.1.2 is used.

How would traffic flow, now it�s important to remember

that IP is a layer 3 technology.

Mac address are used at layer 2

so PC A needs to have a mapping between the layer 3 IP address

and the layer 2 MAC address

that�s because Ethernet is used in this environment
10

and the packet needs to be encapsulated at layer 2 and sent unto the wire.
11

So in Ethernet a MAC address needs to be added at layer 2.
12

So this point PC A doesn�t know the MAC addresses
13

associated with IP address 10.1.1.2.
14

Ethernet once again is a layer 2 technology
15

and requires the use of MAC addresses when traffic is sent unto Ethernet segment
16

so before A can send the traffic onto the network segment
17

it needs to know the MAC address associated with IP address 10.1.1.2
18

I remember that in the OSI model, each layer is independent of other layers
19

and lower layers encapsulate higher layers.
20

So how is PC A going to learn the MAC address of PC C?
21

it does this by using a protocol called Address Resolution Protocol or ARP,
22

the first thing PC A does is check its local ARP cache
23

to see if there is already an existing entry mapping
24

IP address 10.1.1.2 to a MAC address.
25

If there isn't an existing entry on the local machines cache
26

it will send out a broadcast to try and find out
27

who has IP address 10.1.1.2 and that message is called an ARP request message.
28

In this example PC A and PC C are in the same subnet
29

so PC A will send a broadcast unto the local subnet
30

asking for the MAC address of PC C using an ARP request.
31

An ARP request looks as follows
32

The source MAC address in this example is A
33

because the frame was sent by A
34

the destination Mac address is a broadcast.
35

This is because A doesn�t know who has IP address 10.1.1.2
36

So an ARP request is essentially a message asking who has this IP address?
37

so the IP address that's being referenced in the packet is 10.1.1.2
38

the source IP address is 10.1.1.1 the source MAC address is A
39

and the destination MAC address is a broadcast at the layer 2.
40

Just to reiterate, this is the layer 2 portion of the message
41

and this is the layer 3 portion of the message as per the OSI model.
42

Now before continuing with our example
43

I wanna show you a real world example of ARP or Address Resolution Protocol.
44

so on my PC, I can type the command arp-a and I'll see my local ARP cache
45

my IP address is 10.0.0.3 and as you can see here
46

I�ve learnt an IP address of 10.0.0.254 dynamically.
47

there are also some static entries in the ARP cache
48

as an example this is the broadcast address at layer 3
49

which is 255.255.255.255 and the layer 2 address is 8Fs
50

so for a layer 3 broadcast of 255.255.255.255
51

the equivalent layer 2 address is 8Fs
52

in this example we only have 1 dynamic MAC address
53

in the local ARP cache of my pc
54

so the command ip config shows me my IP addresses.
55

In this example we can see my IPv6 address which is 2001:20::2
56

and my IPv4 address of 10.0.0.3
57

at the moment we're only concentrating on IPv4 addresses.
58

So you can also see my default gateway, which will set to 10.0.0.254
59

so my ARP cache is showing the mapping of my default gateways IP address
60

to the relevant MAC address.
61

So the command arp - d will allow me to delete the ARP entries in my local ARP cache.
62

arp - a shows that single dynamic entry, so I'll delete the ARP cache again.
63

And now you can see that there are no entries in the ARP cache.
64

I�ll do that again and notice the entry has appeared once again
65

and that�s because I'm sending traffic from my local PC to my default gateway.
66

I�ll do that again, so arp - a, shows the directed broadcast address
67

for this subnet which is 10.0.0.255
68

I'll now ping another IP address of 10.0.0.123
69

so there was no ARP entry for this IP address.
70

But notice when I ping, the ping succeed
71

and if I look at the ARP cache again,
72

you�ll notice that an ARP entry has been added for IP added 10.0.0.123
73

Now this is another IP address configured on my local router.
74

So the MAC address resolved is the same MAC address
75

as for IP address 10.0.0.254
76

If I delete the ARP cache again, so arp - d
77

notice no entries are found in the ARP cache, still no entry.
78

Let�s ping 10.0.0.123 the ping succeeds
79

and if we look at the ARP cache again notice there�s an entry
80

and the ARP cache now for IP address 10.0.0.123
81

if I now ping my default gateway of 10.0.0.254
82

which previously didn�t have entry in the ARP cache
83

I can now see by using the command arp - a
84

that an IP address to MAC address entry has been created.
85

So what's the moral of the story?
86

Before traffic can be sent to an IP address on the local segment
87

ARP is required to create a mapping between the layer 3 IP address
88

and the layer 2 MAC address.
89

Wireshark is a sniffing tool that allows you to capture traffic
90

of the local wire to see what�s going on.
91

It's invaluable tool for Network Engineer
92

Let's use Wireshark to see what's taking place in this example
93

So what I'll do firstly is start to capture in Wireshark
94

So on my Ethernet interface, I'll start capturing frames
95

I'll now delete the ARP cache
96

so now no entries are found in the ARP cache
97

I'll ping 10.0.0.254
98

and let's look at the ARP cache again
99

after looking at the ARP cache
100

we can see that an entry has been added for that address
101

and I'll now ping 10.0.0.123
102

so now arp - a shows those 2 entries in the ARP cache
103

Let's stop the capture and let's look for the ARP entries
104

So as you can see here is a broadcast that�s been sent from my local device
105

the protocol used is ARP and I�m asking who has IP address 10.0.0.254
106

tell 10.0.0.3 my local PC
107

So at layer 2 you can see that the destination address is a broadcast
108

the source address is my local machine it�s an ARP request.
109

This is the Ether type for ARP 0x0806
110

and looking at the address resolution protocol for ARP information.
111

Notice we're looking for an IP address 10.0.0.254
112

the sender MAC address is my local machine
113

the target MAC address is unknown
114

and we're looking for IP address 10.0.0.254
115

Once the device has replied back using an ARP reply message
116

I'll be able to ping that device.
117

So in the Wireshark capture you can see I'm sending an echo
118

so you can see the ICMP echo ping request
119

and here are I got the response or reply.
120

Going further down I'll be able to see the ARP request
121

for IP address 10.0.0.123
122

the layer 2 destination is a broadcast, the source is a local MAC address
123

and we're requesting the target MAC address in other words
124

who has IP address 10.0.0.123
125

the reply is a unicast because the device are sent
126

the arp request to knows who the arp request came from.
127

So the destination at layer 2 is my local machine.
128

The source is my local router sender the Mac address
129

sender IP address, target MAC address, target IP address.
130

In this case I�m communicating directly with my local router
131

rather than sending traffic through the router
132

So the MAC address and the IP address used in this example
133

is my local machine and local router.
134

You can see in the output here that the sender MAC address is a Cisco router.
135

IP address is 10.0.0.123
136

target MAC address is my local laptop
137

with the target IP address of 10.0.0.3