5 Replies Latest reply: Nov 2, 2010 1:51 PM by Scott Morris - CCDE/4xCCIE/2xJNCIE RSS

    What address is used in routing?


      I am reading about Routing and when L2 address and L3 address is used, but I can't find a clear explanation for it.

      If I have PC1--Router1---Router2--PC2 and PC1 wants to send a packet to PC2. Then PC1 see that PC2 is on another subnet/IP-range so it sends the packet to its default gateway Router1. Does it use the L2 address or L2 when it sends the packet to Router1?

      When I look in my computer I see that the default gateway is an IP-address, but if I look at the packet that is going to be sent then I see that it is the L2 header that is first.


      Then Router1 discard the L2 header/trailer, looks at the IP-packet, see in its routing table that it is supposed to go to Router 2, encapsulates the packet with a new L2 header/trailer. What address is used now? does Router1 send it to Router2s L2 or L3 address?


      Will be greateful for any help.



        • 1. Re: What address is used in routing?
          Paul Stewart  -  CCIE Security

          I think you have most of this concept down.  PC1 is sending a Packet to PC2.  A packet has a logical source and destination address in its header.  In most cases we are working with IP so we are talking about the source IP address (of PC1) and the destination IP address (of PC2).  These should not change through the path.  The one exception is if there is a NAT router in the middle.  However, where we talk about this concept, the addresses are constant.


          The layer two addresses change to the addresses relevant to each segment along the way.  So if the packet is not local, PC1 will need to forward it to its default gateway.  That gateway is just their for the purposes of building the pc's routing table and instructing the PC what to arp for.  The PC will frame the packet (basically envelope the packet) and set a source L2 (mac) address of its own interface card.  The destination will be the mac address found in the arp table or that derived from an arp request.  So the frame between PC1 and R1 will have a source mac address of PC1 and a Destination mac address of R1.  The IP address of R1 will NOT be found in the packet.


          R1 will remove the layer 2 information and look at the IP packet.  The job of the router is to route the packet so it looks at the destination IP address.  This is the address of PC2.  R1 determines which interface and then determines how it should be framed.  If that interface is Ethernet, it will need to be framed as such and will receive the source mac address of R1.  The destination address will ultimately be that of R2 (but it will need to be derived from the arp table or an arp request).


          R2 will go through exactly the same process as R1 and remove the ethernet framing.  Upon examination of the destination IP address, it will see that it should be routed out a directly connected interface.  R1 will need to re frame this packet into a frame and will use its mac address is the source and the mac of PC2 as the destination.  This again can be derived from the arp table or through an arp request.


          Moral of the story.  IP addresses should be constant, but mac addresses change as packets are re-encapsulated through a network.  Also, all hops along the way might not be ethernet, so in the case of other media, framing may use something else for addressing.

          • 2. Re: What address is used in routing?
            Aimen Khudair

            Hi Phi,


            First you have to know that L2 address is used for local communication in the same subnet ( network), L3 address come into play when you are communicating with remote devices.


            So, in your case when you are sending packets from PC1 to PC2, and as you said PC1 will find that PC2 is in another subnet, and as a result PC1 will try to locate it's default gateway, either by issuing an ARP message to resolve it's default gateway IP address to L2 address, or by inspecting the ARP cash table. then PC1 gonna send the packet to its default gateway with source MAC address of PC1mac@ and the destination MAC address will be Router1's interfacemac@.


            Then router 1 will discard layer 2 header and trailer  and will check the destination IP address in the packet and it will discover that this packet is not for him, then router1 build new layer 2 header and trailer with the forwarding port 's MAC address as the source mac@ and the destination will be Router2's interfacemac@, Router 2 will do the same with the received frame.


            what you have to know is that during all this process L3 addresses will never change ( unless you have NAT in the middle ), the original packet has PC1's IP address as the source ip address and PC2's IP address as the destination ip address, and it will not change until the packet reaches PC2.


            hope that is helpful.




            • 3. Re: What address is used in routing?

              Wow this is verry intresting. Thanks for the answers. But why doesn't the PC or router save the L2 address instead of the IP address? Then there would be no need for ARP.

              • 4. Re: What address is used in routing?
                Aimen Khudair

                Well, of course they save it in the ARP table, to check that you can use the does command ( arp -a ) for the PC, and for the router it is show ip arp, or just show arp.




                • 5. Re: What address is used in routing?
                  Scott Morris - CCDE/4xCCIE/2xJNCIE

                  Phi wrote:


                  Wow this is verry intresting. Thanks for the answers. But why doesn't the PC or router save the L2 address instead of the IP address? Then there would be no need for ARP.


                  You want to do away with ARP?    The ARP table saves things.  On a router, the default timeout is 4 hours (Cisco anyway).  On a PC (Windoze) it's 2 minutes.


                  The timeout capability gives us the ability of having multiple responses/load balancing/first hop failover and things like that to increase the availability of our network.  If it were pre-set, then everything would be static (which you CAN do static ARP entries if you wish).


                  Everything has a dynamic sense to it, and that's what gives us fluidity to our networks!