Ethernet Frames 1

[oneciscokid]

I'm having trouble understanding how the following Frame is created. Let's say for example you're a home user behind a router running NAT with the following configuration.

IP: 192.168.1.100
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
MAC_Address: 00:00:00:11:11:11
MAC_Address of the Gateway: 55:55:55:66:66:66

Let's say you want to visit

http://www.google.com,

and DNS resolution has already been done so the webpage is at 64.233.187.99.

In the IP Header, source is 192.168.1.100 and destination is 64.233.187.99 which I understand. Now we put on the Ethernet Header. So the source MAC address is 00:00:00:11:11:11 but the MAC address for the destination is 55:55:55:66:66:66. I know it can't be the MAC address of 64.233.187.99 because it's not on the same network therefore it can't find it through ARP. But I'm wondering why is the MAC address the default gateway then? What is the process that it goes through to put it in?

 

[KiscoKid]

If a host has to communicate with a host that doesn't reside on its local subnet, it will always resolve the MAC address of its default gateway instead and use that MAC address as the destination MAC address.

If the default gateway has an interface that is locally-connected to

http://www.google.com,

it will rewrite the destination MAC to be that of 64.233.187.99 and rewrite the source MAC address to be its own interface. If it doesn't have a local connection to

http://www.google.com,

it will simply specify a destination MAC address of its own default gateway.

This process continues until the frame is delivered to the desination.

 

[pansophic]

I think that is a good explanation KiscoKid.

But I'll contribute anyway.

Because the MAC address is at Layer 2, the source and destination MACs change at every hop.

Source IP Default GW Destination IP
MAC 1 ------ MAC 2 MAC 3 ------ MAC 4
Link 1 Link 2

If you were to look at the packet from Source IP to Destination IP as it traverses the two links (----) you would see a source MAC of MAC 1 and a destination MAC of MAC 2 on Link 1. Then you would see a source MAC of MAC 3 and a destination MAC of MAC 4 on Link 2.

For the most part, unless you are looking for a datalink problem, you can safely ignore the MAC addresses in your captures.


pansophic

 

[chieftan]

Pansophic is quite correct.

The MAC address will change at each hop......