CodeTyro sent us the following message:
My Networking Professor said in his lecture that the MAC address changes
at every hop. Yet, in my experience (yes I've sniffed a few packets and
learned about the physical layout as I'm a CS major), it seems that this
cannot be correct. If this were true, then I surmise every packet would
contain the most recent layer 2 router's MAC address. This, however, is
not the case as the MAC addresses vary. So I'm wondering if the MAC
address changes at every hop; if not, how does transportation over layer 2
work? If I were to see the packet at every hop, would the MAC address be
the same? If it does remain the same, how does addressing at layer two
affect hop-to-hop transmission?
CodeTyro,
> then I surmise every packet would contain the most recent layer 2 router's MAC address.
It does.
The thing most people forget is that IP data is encapsulated within the network-hardware protocol being used for communication within that LAN environment (eg. Ethernet). That is to say, the Ethernet frame has a payload section which contains the IP datagram. They also forget that at layer 2, switches and hubs aren't 'hops'--for most practical purposes, only routers are 'hops'. Finally, most people forget that a packet only travels from the source host, through network equipment to the destination. Therefore,the ethernet frame (and thus the MAC addresses it contains) only gets changed when it reaches the next routing hop. Ethernet confuses people because it is a 'broadcast' protocol--the packet is broadcasted to all hosts on the network, but the packet is only 'destined' for the host whose MAC address matches the one in the desitnation MAC field of the Ethernet frame. Just because you can sniff packets on your computer and can see communication between two other hosts on the network doesn't mean your computer is actually part of the communication going on between them. Ethernet is like talking to a person in a crowded room. Everyone hears you, they just ignore the conversation you're having with Joe because you are talking to Joe, not to any of them.
Let's set up an example:
1. Suppose you have three ethernet networks (Networks A, B and C)
2. The hosts on each ethernet network use a hub to communicate from host to host within the network.
3. The three networks are connected by two routers as follows:
{Net A}--(R1)--{Net B}--(R2)--{Net C}
4. In the diagram above, the dashes represent switched ethernetconnections between hosts. Yes, a router is a host, it's also a router.
5. Nets A, B and C each use ethernet hubs [hA, hB & hC] like so
[hA]----(R1)----[hB]----(R2)----[hC]
6. Next, we add two hosts on Network A for our first example. Here's a diagram
A1 C1 | | [hA]----(R1)----[hB]----(R2)----[hC] | A2
Simply put, the MAC addresses in the communication between A1 and A2 won't change but only if you're talking about traffic on a single network. The MAC addresses *will* change when there is communication between A1 and C1 or between A2 and C1. This is because it is necessary to talk to the default gateways on each network (R1, R2) in order to reach hosts that aren't on your local ethernet network. More precisely, when host A1communicates with host C1, host A1 will address the ethernet frame to the default gateway R1. R1 will address the new ethernet frame it creates for this communication to R2. R2 will create a new frame and address it to C1.
At each hop, the host pairs communicating change, so the MAC addresses change. The IP data inside the Ethernet frames created at each hop always contains A1 and C1's IP addresses. Thus IP maintains a logical connection from end to end across the routers and Ethernet handles host-to-host communication within each network. If I've explained everything clearly enough, you should understand.
If not, read on..
Case #1: Internal communication within the LAN (host-to-host)
1. Host A1 'finds' Host A2's MAC address, creates a frame and sends it
to the hub which broadcasts the frame to the rest of the ethernet network.
This frame A1 sends will contain:
[ETHERNET HEADER...
Destination MAC: Host A2
Source MAC: Host A1
other Ethernet header fields]
[ETHERNET PAYLOAD SECTION]
<IP HEADER
Destination IP: A2
Source IP: A1
>
2. Remember that the hub is just an electrical repeater--if we were using a switch, it's just a 'smart' repeater and behaves the same way. Neither a hub or a switch would change the MAC addresses because it isn't a 'hop'.
3. Host A2 receives the Ethernet frame, recognizes that the destination field of the Ethernet frame is it's own MAC and accepts the frame, removes the ethernet data, recomposes the IP data and uses the data IP is carrying for whatever program you're using.
4. In this example, R1 sees the communication between A1 and A2, but ignores it because A1 wasn't talking to R1.
Case #2: External communication between stations on different LANs (end-to-end)
Using the same diagram, let's suppose A1 wants to talk to C1.
1. A1 and C1 are on different networks. In reality, A1 can only communicate with hosts on Net A using Ethernet.
2. To communicate with C1, A1 must use IP because Ethernet can only talk to local stations.
3. Host C1 isn't on network A, so host A1 will have to send the Ethernet frame to the local default gateway (R1). This ethernet frame contains A1 and R1's MAC addresses. Inside the Ethernet frame is an IP datagram. The IP datagram contains the source IP for A1 and destination IP for C1.
4. R1 isn't connected to network C (where C1 resides), but it is configured to send IP data for any IP address it doesn't know how to reach to router R2 (R2 is R1's default gateway). R1 must talk to R2 if it's going to pass A1's IP data to C1. R1 constructs an ethernet frame that contains its own MAC and R2's MAC and inside the Ethernet frame is an the IP datagram. Inside the datagram is the source IP for A1 and destination IP for C1.
5. R2 does know where C1 is because C1 is on network C and so is R2. R2 sends an ethernet frame addressed to C1.
So, to summarize:
1. IP address pairings map up the endpoints and don't change during communication between end points.
2. MAC address pairs only change when the hosts communicating at the Ethernet layer change. As an IP datagram is forwarded, the Ethernet frame that contains it will change MAC addresses. It will contain the MAC of the specific hosts that are communicating across a single ethernet network.
3. If you sniff the communication at any hub or switch, you will only see one set of MAC addresses as part of that communication. If you are sniffing traffic at the router, you will see two pairings of MAC addresses: one pair of addresses for the communication on each network.
--InetDaemon