When a host sends data to a remote destination, it must first send the packet to its default gateway (router) - The host recognizes the destination is in a different network by comparing the destination IP with its own subnet.
The original IP packet header remains unchanged throughout the entire journey - Source and destination IP addresses stay constant from origin to final destination.
Only the Layer 2 (Ethernet) header changes at each hop - Each router de-encapsulates the frame, examines the IP header, then re-encapsulates with new MAC addresses for the next hop.
ARP (Address Resolution Protocol) is used whenever a device needs to discover the MAC address of another device on the same network segment - This includes router-to-router communication on shared links.
Switches forward frames without modifying them - They learn MAC addresses and make forwarding decisions but don't change the frame's source or destination MAC addresses.
Each interface on a network device has its own unique MAC address - A router with multiple interfaces will have multiple different MAC addresses.
Layer
What Changes
What Stays Same
Layer 3 (Network)
Nothing
Source IP, Destination IP
Layer 2 (Data Link)
Source MAC, Destination MAC
Frame structure
Term
Definition
Encapsulation
Adding a header (and sometimes trailer) to data as it moves down the OSI layers
De-encapsulation
Removing headers as data moves up the OSI layers
Default Gateway
The router interface a host uses to reach remote networks
ARP Request
Broadcast message asking "What is your MAC address?"
ARP Reply
Unicast response containing the requested MAC address
Broadcast MAC
FFFF.FFFF.FFFF - sent to all devices on local network
Unicast
Frame sent to a single specific destination
Next Hop
The next router's IP address in the path to destination
Item
Value
Broadcast MAC Address
FFFF.FFFF.FFFF
MAC Address Length
48 bits (12 hex characters)
IPv4 Header Order
Source IP before Destination IP
Ethernet Header Order
Destination MAC before Source MAC
Confusing which address changes vs. stays the same
❌ Wrong: "The destination IP changes to the router's IP at each hop"
✅ Correct: "Only the destination MAC changes; destination IP stays the same"
Thinking switches modify MAC addresses
❌ Wrong: "SW1 changes the source MAC to its own"
✅ Correct: "Switches forward frames unchanged; only routers modify L2 headers"
Forgetting ARP is needed at EACH hop
Each router must ARP for the next-hop device if it doesn't have the MAC cached
Confusing ARP request vs. reply behavior
ARP Request = Broadcast (doesn't know target MAC)
ARP Reply = Unicast (learned source MAC from request)
Header field order confusion
Ethernet: Destination MAC first
IPv4: Source IP first
"IP stays, MAC changes"
IP addresses = Final destination (like a mailing address)
MAC addresses = Current hop (like the delivery truck)
"ARP: Ask Broadcast, Reply Unicast"
Request: "I don't know who you are, so I'll ask everyone"
Reply: "I know who asked, so I'll reply directly"
Mnemonic for Ethernet header order: "DeStiMac"
Destination MAC comes first, then Source MAC
Mnemonic for IPv4 header order: "SIP before DIP"
Router Process at Each Hop: "RDR"
Receive frame, De-encapsulate
Route lookup (check routing table)
Re-encapsulate with new L2 header
Scenario: PC1 (192.168.1.1) sends to PC4 (192.168.4.1)
Location
Src MAC
Dst MAC
Src IP
Dst IP
PC1 → R1
1111
AAAA
192.168.1.1
192.168.4.1
R1 → R2
BBBB
CCCC
R2 → R4
DDDD
EEEE
R4 → PC4
FFFE
4444
Notice: IP addresses never change. MAC addresses change at every router hop.
When a host sends a packet to a device in a remote network, what is the destination MAC address in the Ethernet header?
The MAC address of the host's default gateway (local router interface)
What is the broadcast MAC address used in ARP requests?
Does the destination IP address change as a packet traverses multiple routers?
No, the destination IP address remains constant throughout the entire journey. Only Layer 2 (MAC) addresses change at each hop.
Why is an ARP request sent as a broadcast while an ARP reply is sent as unicast?
The ARP request is broadcast because the sender doesn't know the target's MAC address. The reply is unicast because the target learned the sender's MAC from the request.
In an Ethernet header, which comes first: source MAC or destination MAC?
Destination MAC comes first
In an IPv4 header, which comes first: source IP or destination IP?
Source IP comes first
What does a router do when it receives a frame destined for a remote network?
1) De-encapsulates (removes Ethernet header), 2) Looks up destination in routing table, 3) Re-encapsulates with new Ethernet header using next-hop MAC addresses
Do switches modify the source or destination MAC addresses when forwarding frames?
No, switches forward frames without modifying them. They only learn MAC addresses and make forwarding decisions.
What triggers a device to use ARP?
When a device needs to send a frame to an IP address on the same network segment but doesn't have the corresponding MAC address in its ARP cache
How do switches learn MAC addresses?
By examining the source MAC address field of incoming frames and associating it with the port the frame arrived on
If PC4 sends a packet to PC1, and it's received on R1's Gi0/0 interface, what is the source MAC address?
R2's G0/0 interface MAC address (the last router that forwarded it to R1)
Does each interface on a router have its own MAC address?
Yes, each interface on a network device has a unique MAC address
PC1 is in 192.168.1.0/24 and wants to send to 192.168.4.1. How does PC1 know to send to its default gateway?
PC1 compares the destination IP to its own subnet and determines 192.168.4.1 is in a different network, so it must send to its configured default gateway
What information does a device include in an ARP request message?
Source IP address, Source MAC address, Target IP address, and Broadcast MAC (FFFF.FFFF.FFFF) as destination
What happens when a router needs to forward a packet but doesn't know the next-hop's MAC address?
The router sends an ARP request for the next-hop IP address to learn the MAC address before forwarding the packet
In the "life of a packet," what remains constant and what changes?
Constant: Source IP, Destination IP (Layer 3). Changes: Source MAC, Destination MAC (Layer 2) at each router hop
Why doesn't the source IP address change to the router's IP when a router forwards a packet?
Routers operate at Layer 3 but only modify Layer 2 headers. The original IP packet must remain intact so the destination knows who originally sent the data.
What is the difference between how switches and routers handle frames?
Switches forward frames at Layer 2 without modification. Routers de-encapsulate, make Layer 3 routing decisions, then re-encapsulate with new Layer 2 headers.
When R1 sends an ARP request to discover R2's MAC address, what source MAC address does R1 use?
The MAC address of the interface R1 is sending the ARP request from (the interface connected to R2's network)
After all devices have communicated once, what is different when PC4 sends a reply back to PC1?
No ARP requests/replies are needed because all devices have cached the MAC addresses from the initial communication. The packet simply forwards hop-by-hop.
Zuletzt geändertvor einem Monat