All language subtitles for 23. Does a router change the MAC address or IP address

So what happens if A now wants to ping a remote device in a separate subnet?

So now for example, A with IP address 10.1.1.1

Wants to ping device B with IP address 10.1.2.1

In these examples I�m discussing ICMP or ping traffic

but something similar would happen

if you were sending HTTP, FTP or other traffic.

what�s important to note here is that these devices are in separate subnets

we are using a /24 mask in this topology.

So host A is not in the same subnet as host B.
10

now the first thing the PC will do is to check whether the IP address
11

it's trying to communicate with is in a separate subnet
12

or in the same subnet as itself.
13

It does this by doing a logical end using the network mask.
14

So in this case we�ve got /24 mask
15

the IP address of PC A is 10.1.1.1
16

and it�s trying to ping an IP address 10.1.2.1/24
17

in dotted decimal notation looks like this 255.255.255.0
18

Which means the network portion is the first 3 octets of the address.
19

So the local PC 10.1.1.1 compares the network portion with the device that
20

it's trying to communicate with to check if the device is local or remote.
21

In this case the network portion of the address is different.
22

So the local PC knows that the remote device is in a different subnet
23

to itself and it will therefore send the traffic to its default gateway
24

to get to the remote subnet on which the device resides.
25

Now in this example we are assuming that device A
26

has a default gateway configured.
27

So device A has been configured with the default gateway of the router
28

10.1.1.100 so the PC will firstly check if it has the router's MAC address
29

in its local ARP cache
30

It does this because its need to send the traffic
31

to the router to get to the remote device.
32

And because this is an Ethernet segment a layer 2
33

Mac address is required for communication.
34

Ethernet once again requires that MAC address is be use at
35

layer 2 for transmission across an Ethernet network.
36

So at layer 2 a Mac address is required by the PC
37

the PC would have been configured with the default gateway of 10.1.1.100
38

which is an IP address at layer 3
39

but the MAC address of the default gateway wouldn�t have been
40

configured on the PC, so there�s no entry on the local PC
41

for the MAC address of its default gateway
42

and thus it will need to send out a broadcast unto the segment
43

asking who has IP address 10.1.1.100 in other words
44

this is an ARP request looking for the MAC address
45

associated with the IP address of the default gateway.
46

When the broadcast is received by the hub, it will flood it out of all ports
47

except the ports on which they arrived
48

PC C will receive the broadcast at layer 2
49

but when reading the layer 3 information it will see that
50

this is an ARP for 10.1.1.100 which is not its IP address.
51

So PC C will therefore drop the ARP request.
52

The router however will process the ARP request.
53

Firstly it will receive the traffic at layer 2
54

because this is a broadcast and when it reads the layer 3 information
55

it will see that this is an ARP request for its IP address.
56

So the router will reply with an ARP reply to PC A ARP request.
57

The ARP reply is a unicast address so source MAC address is G
58

the router's MAC address, destination MAC address is A
59

source IP address is the router's IP address
60

destination IP address is A IP address.
61

The hub will once again flood the traffic out of all ports
62

except the port on which it arrived.
63

C will drop the frame because it's not destined to itself.
64

Notice in the frame the destination MAC address is A
65

but the PCs MAC address is C, so it will drop the frame.
66

And what�s important to note is that it�s the Network Interface Card
67

that drops the frame and not the central CPU of the PC.
68

A will receive the frame and upon a receipt will process the frame
69

because the destination MAC address is itself.
70

So at layer 2 the frame is accepted by the NIC or Network Interface Card .
71

The layer 2 information is strip and forward it to high layer protocols.
72

Because this is an ARP reply its process by high layer protocols
73

and the ARP cache is updated with the MAC address of the router, so PC A
74

now has a mapping saying that IP address 10.1.1.100 uses MAC address G
75

so this is the important, PC A knows that the IP address
76

10.1.1.100 is associated with MAC address G.
77

So the PC can send traffic to the network destined for the remote PC 10.1.2.1
78

with the source IP address set to 10.1.1.1 itself
79

but notice please that the source MAC address is the local PC
80

and the destination MAC address is the router.
81

The layer 2 frame goes to the router and hence the layer 2
82

information contains the local segment MAC addresses.
83

Source MAC address the PC, destination MAC address the router.
84

The layer 3 information contains the destination IP address
85

of the remote host and the local PCs IP address.
86

The hub will flood the frame to both c and G, C will drop the frame
87

because the destination MAC address is not itself
88

the router will receive the frame at layer 2
89

because its destined to its MAC address of G.
90

It will then strip the layer 2 information
91

and read the layer 3 information in the packet.
92

So now let�s look at a practical example
93

I�m going to capture traffic in Wireshark, so I'll start the capture
94

I�m gonna clear my ARP cache, so arp-a shows that no entries
95

are in the ARP cache at the moment and then I�m gonna ping hp.com
96

notice the DNS resolution has taking place, ICMP message has timing out
97

because a firewall is blocking the ICMP messages to that server.
98

So here�s another example, lets ping Google com.
99

Notice pings are succeeding, so I�ll stop the capture.
100

HP was using an IP address in the 15 range.
101

So let�s have a look for that ICMP traffic
102

so notice there�s an ICMP message to hp.com
103

and you can see that because the address is 15.
104

And HP own the 15 IP address range.
105

We didn�t get a reply from the server but the echo request was sent.
106

What I�d like you to see please is that at layer 2
107

the source MAC address is my local pc
108

but the destination MAC address is my local router.
109

Notice I can see that this is a Cisco device because the MAC address
110

is shown as Cisco for the OUI or vendor portion of the address.
111

We can see that by typing arp-a
112

notice this MAC address is the MAC address associated with IP address
113

10.0.0.254 IP config shows us that
114

that is the IP address of the default gateway.
115

So the traffic is going from my local PC to hp.com
116

but it�s being routed by my local router.
117

At layer 3 we have the local PC's IP address
118

the destination IP address is hp but at layer 2
119

the source MAC address is my PC
120

and the destination MAC address is the local router.
121

And once again sending the traffic to my local default gateway at layer 2.
122

I can filter the Wireshark capture to show only ICMP traffic again.
123

Here�s traffic going to Google so source IP address is my local machine
124

destination IP address is Google but notice at layer 2
125

the source MAC address is my local PC
126

and the destination MAC address is once again the local router.