0

I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it showed the ip address and cisco_ followed by the start of what appears to be a mac address, e.g. cisco_fa:dd:b8, how come it shows cisco? Is this because its a remote host? As when I ping PC 2 from PC 1, cisco isn't displayed it just displays the ip address and mac address.

enter image description here

The_Bear
  • 515
  • 1
  • 5
  • 11

1 Answers1

3

If I understand correctly, PC3 is on the other side of a router from PC1 and PC2. Layer-2 addresses are only relevant on the same network.

When a host is sending to the same network, the destination layer-2 (MAC) address will be that of the destination host.

A host sending to a different network will use the destination layer-2 (MAC) address of its configured gateway because that is the destination on the same network.

A router will strip off the layer-2 frame in order to route the layer-3 packet. The router will then build a new frame for the new interface, and the source layer-2 (MAC) address will be that of the router on the sending router interface.

Ron Maupin
  • 98,218
  • 26
  • 115
  • 191
  • but why does it start with cisco_ – The_Bear Mar 05 '19 at 20:12
  • Because it is a Cisco router, and that is simply replacing the OUI with that to explain that it is a Cisco device. You see that in Wireshark with well-know vendors. – Ron Maupin Mar 05 '19 at 20:14
  • So does that mean that it is showing the MAC address for router 2’s default gateway as PC 3 is connected to router 2? Not router 1? – The_Bear Mar 05 '19 at 23:21
  • You did not provide a diagram or configurations, so I cannot answer that. – Ron Maupin Mar 06 '19 at 03:09
  • I've added diagram to show you – The_Bear Mar 06 '19 at 09:38
  • For a packet from PC1 or PC2 to PC3, PC3 will receive a frame with the source address of R2. R1 will strip off the frame, forward the packet to the interface toward R2, build a new frame for that interface, and send the new frame to R2. R2 will strip off the frame, forward the packet to the interface toward PC3, build a new frame for that interface, and send the frame to PC3. Most likely, the PCs are on LANs that use MAC addresses, but the link between R1 and R2 looks like a serial link that would use PPP, which does not use MAC addresses (not all layer-2 protocols do). – Ron Maupin Mar 06 '19 at 15:47
  • @The_Bear, see my answer to [this question](https://networkengineering.stackexchange.com/q/56643/8499). – Ron Maupin Mar 06 '19 at 15:49