Where Is Packet Lunchbox?

What happens to a Packet in a router?

• I have been racking my brain searching the internet trying to determine exactly what happens to a packet inside a router before its sent from the local network to the internet. Please someone finish the following for me (i simplified mac address for less typing). Lets say HOST A (IP: 10.10.10.100 / MAC address A) sends a packet destined for the Internet lets say WEBSERVER B (IP: 175.1.1.100 / MAC address B). Then ROUTER C (IP: 235.1.1.200 / MAC address C) handles the request. I dont care in this example that it could be several hops from ROUTER C to WEBSERVER B. Just simple for this example. So the packet leaves HOST A Source IP: 10.10.10.100 Source MAC: A Dest IP: 175.1.1.100 Dest MAC: ?? (would it be B or unknown) The packet then arrives at ROUTER C and the router then sends the pack out on the internet towards WEBSERVER B. Source IP: ?? (this should be changed to the ROUTERS public IP correct?) Source MAC: ?? (will this be changed to the ROUTERS or stay the same as the HOST A?) Dest IP: 175.1.1.100 Dest Mac: ?? Once WEBSERVER B receives the packet and sends back the requested info, what would its packet look like? Source IP: 175.1.1.100 Source Mac: B Dest IP: 235.1.1.200 Dest Mac: ?? (would this be the routers or HOST A's?)

• Answer:

  First, we need to get our terminology straight. A packet is strictly Layer 3 - IP. When you start to talk about MAC addresses, you're getting into Layer 2, which is made up of frames. A packet is encapsulated into a frame as it's passed between ethernet devices. Also remember that in our router we'll have at least two interfaces, each with it's own IP and it's own MAC. I'm not quite sure why in your illustration you have the router on a different network than either the host or the webserver, so I'm altering it a bit for clarity). Host A has one network interface, with one IP address (10.10.10.100)and one MAC address (A). Router C has TWO network interfaces, two IPs (10.10.10.200 on the side facing Host A, and 175.1.1.200 on the side facing the webserver), and two MACs (C1 on the side facing Host A, and C2 on the side facing the webserver). Webserver B has one network interface, with one IP (175.1.1.100), and one MAC (B). Our network now looks like: HostA (10.10.10.100, MAC: A) <---> (10.10.10.200, MAC C1) RouterC (175.1.1.200, MAC C2) <---> (175.1.1.100, MAC B) WebserverB MAC addresses are only useful to devices on the same ethernet segment, so when your packet leaves Host A, it is encapsulated into a frame with source and destination MACs to govern the next physical hop. The destination MAC will be the MAC of the next physically connected device (in this case it's your router). Your frame/packet combination looks like this: SIP (source IP): 10.10.10.100 SMAC (source MAC): A DIP (destination IP): 175.1.1.100 DMAC (destination MAC): C1 When it gets to the router, the frame is removed, the packet is processed and sent toward the interfaces that faces the webserver. How the packet will look on egress will depend on whether or not you're running NAT. Since Host A is using a 10.x.x.x address, I assume you are, but I'll provide results for both ways. In either case, the router first reads and acts on the packet, then re-encapsulates it into a new frame. If you're NOT running NAT, the packet and frame now look like: SIP: 10.10.10.100 SMAC: C2 DIP: 175.1.1.100 DMAC: B The IP does not change, because the comunication is still between Host A and Webserver B. If the IP changed, the webserver would try to send a reply back to the router directly, rather than *through* the router to the host that made the request. If you ARE running NAT, then the frame/packet leaving the router looks like: SIP: 175.1.1.200 SMAC: C2 DIP: 175.1.1.100 DMAC: B The router is here acting as a proxy for the computer behind it. It swaps the private IP for a public one. Otherwise, everything is the same. When Webserver B receives the frame, it decapsulates the packet, and the response again depends on whether you're running NAT or not. If you are NOT running NAT, the frame/packet looks like: SIP: 175.1.1.100 SMAC: B DIP: 10.10.10.100 DMAC: C2 If you ARE running NAT, the frame/packet will look like: SIP: 175.1.1.100 SMAC: B DIP: 175.1.1.200 DMAC: C2 Again, the only difference is one IP. At the risk of repeating myself, MAC addresses are only useful to devices on the same ethernet segment. In other words, the MAC of Host A and the MAC of Webserver B will never cross paths because there is a router between them. The router is the only one that ever sees both foreign MACs. A last couple of points about MAC addresses: First, they're only used on Ethernet devices. If you ever have to deal with T1s or SONET or anything in the telco world, recognize that you won't be discussing MAC addresses at all. Second, I mentioned the idea of physical hops previously. If you were to string a bunch of switches together in series, like below (fake MACs in parentheses): Host A (A) --- (S1A) Switch1 (S1B) --- (S2A) Switch2 (S2B) --- (S3A) Switch3 (S3B) --- (R1) router (R2) ---> etc. Then the encapsulation of your packet into an ethernet frame along every segment will cause the MAC addressing (source and destination) to change. When it leaves Host A the SMAC will be (A) and the DMAC will be (S1A). As it leaves Switch1 to go to Switch2, the SMAC will be (S1B) and DMAC will be (S2A), and so forth.