Networking – Trying to understand IP packet flow

ipnetworkingpacketroutertcpip

So I'm having trouble understanding how packets travel from one machine to another. Below I've put in an example of Computer 1 trying to connect to Computer 2.

Computer 1  
IP: 192.168.1.11  
Subnet: 255.255.255.0  
Default Gateway: 192.168.1.1  
MAC: 00:00:00:00:00:aa

Router 1  
IP: 192.168.1.1  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:bb  

Router 2  
IP: 192.168.2.1  
Subnet: 255.255.255.0  
MAC: 00:00:00:00:00:cc  

Computer 2   
IP: 192.168.2.1  
Subnet: 255.255.255.0  
Default Gateway: 192.168.2.12  
MAC: 00:00:00:00:00:dd

If I connected from Computer 1 to Computer 2 and followed the flow of a packet I believe that the source address from what the information leaves router 2 would be 192.168.1.2 and the source MAC address would be 00:00:00:00:00:cc. From my understanding the destination stays the same but the source will update as it goes through its path. Is this correct or is their something I'm missing?

Best Answer

Whew. This is a bit of a tricky one given your scenario.

First off, router 2 shouldn't share an interface with router 1 that is also on their client-side interfaces.

In your example, all 4 devices share the same LAN segment, which as an aside is in the non-routable (edit: across the "Internet") IP address range for the 192.168.x.y family.

A better way would be to think of it as follows:

Computer 1
IP: 192.168.1.100
Subnet: 255.255.255.0
Default Gateway: 192.168.1.1
MAC: 03:00:00:00:00:11

Router 1
IP: 192.168.1.1
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:22
IP: 192.168.12.1
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:33

Router 2
IP: 192.168.12.2
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:44
IP: 192.168.2.1
Subnet: 255.255.255.0
MAC: 03:00:00:00:00:55

Computer 2
IP: 192.168.2.200
Subnet: 255.255.255.0
Default Gateway: 192.168.2.1
MAC: 03:00:00:00:00:66

Ignore the fact that the MAC's lead with a 03 hex character, that's just for correctness for the network snobs out there. [EDIT] I had to amend it to 0x03 for it to be both locally assigned and globally unique.

So what is happening here is: There's a cable from Computer 1 plugged into Router 1. These two share the 192.168.1.x network. There's a cable from Router 1 to Router 2. These share the 192.168.12.x network. There's a cable from Router 2 to Computer 2. These share the 192.168.2.x network.

In your original write-up, all 4 devices would have had to be connected to the same switch in order for it to even work... and in such a case Computer 1 would've talked directly to Computer 2. Note: for you network wizards out there I know you can do static routing to force the original network configuration to work, but that isn't what this User is asking about....

Now on to your specific question.

You are half correct. The MAC address that Computer 2 see's is that of Router 2. In my example that would be MAC 03:00:00:00:00:55. However, the IP address it see's is of Computer 1. That is how Computer 2 can respond back to Computer 1. IP addresses are, theoretically, "universally unique."

The way networks work, given your level of intent of knowledge, is that layer 2 (datalink / MAC-layer - in an all Ethernet/IPv4 environment) addresses change PER HOP. PER HOP is defined as 'transiting any layer-3 processing device'. Router's and computers almost always process layer 3. Switches can process layer 3 but they tend to leave it alone.

So as a message goes from Computer 1 to Computer 2 the flow looks like:

AT HOP 1 - Between Computer 1 and Router 1

SourceIP: 192.168.1.100 (Computer 1)
SourceMAC: 03:00:00:00:00:11 (Computer 1)
DestIP: 192.168.2.200 (Computer 2)
DestMAC: 03:00:00:00:00:22 (Router 1 - Interface facing Computer 1)

AT HOP 2 - Between the routers

SourceIP: 192.168.1.100 (Computer 1)
SourceMAC: 03:00:00:00:00:33 (Router 1 - Interface facing Router 2)
DestIP: 192.168.2.200 (Computer 2)
DestMAC: 03:00:00:00:00:44 (Router 2 - Interface facing Router 1)

AT HOP 3 - Between Router 2 and Computer 2

SourceIP: 192.168.1.100 (Computer 1)
SourceMAC: 03:00:00:00:00:55 (Router 2 - Interface facing Computer 2)
DestIP: 192.168.2.200 (Computer 2)
DestMAC: 03:00:00:00:00:66 (Computer 2)

So you see, the IP address layer (layer 3) addresses stay the same across the entire communication, but the datalink layer (layer 2) addresses change each time another device that processes a layer3 address is involved.

I hope this helps. If it's still confusing feel free to message back and I'll try to explain the specific subset that you're finding challenging.

Related Question