So what happens if A now wants to ping a remote device in a separate subnet?
So now for example, A with IP address 10.1.1.1
Wants to ping device B with IP address 10.1.2.1
In these examples I’m discussing ICMP or ping traffic
but something similar would happen
if you were sending HTTP, FTP or other traffic.
what’s important to note here is that these devices are in separate subnets
we are using a /24 mask in this topology.
So host A is not in the same subnet as host B.
now the first thing the PC will do is to check whether the IP address
it's trying to communicate with is in a separate subnet
or in the same subnet as itself.
It does this by doing a logical end using the network mask.
So in this case we’ve got /24 mask
the IP address of PC A is 10.1.1.1
and it’s trying to ping an IP address 10.1.2.1/24
in dotted decimal notation looks like this 255.255.255.0
Which means the network portion is the first 3 octets of the address.
So the local PC 10.1.1.1 compares the network portion with the device that
it's trying to communicate with to check if the device is local or remote.
In this case the network portion of the address is different.
So the local PC knows that the remote device is in a different subnet
to itself and it will therefore send the traffic to its default gateway
to get to the remote subnet on which the device resides.
Now in this example we are assuming that device A
has a default gateway configured.
So device A has been configured with the default gateway of the router
10.1.1.100 so the PC will firstly check if it has the router's MAC address
in its local ARP cache
It does this because its need to send the traffic
to the router to get to the remote device.
And because this is an Ethernet segment a layer 2
Mac address is required for communication.
Ethernet once again requires that MAC address is be use at
layer 2 for transmission across an Ethernet network.
So at layer 2 a Mac address is required by the PC
the PC would have been configured with the default gateway of 10.1.1.100
which is an IP address at layer 3
but the MAC address of the default gateway wouldn’t have been
configured on the PC, so there’s no entry on the local PC
for the MAC address of its default gateway
and thus it will need to send out a broadcast unto the segment
asking who has IP address 10.1.1.100 in other words
this is an ARP request looking for the MAC address
associated with the IP address of the default gateway.
When the broadcast is received by the hub, it will flood it out of all ports
except the ports on which they arrived
PC C will receive the broadcast at layer 2
but when reading the layer 3 information it will see that
this is an ARP for 10.1.1.100 which is not its IP address.
So PC C will therefore drop the ARP request.
The router however will process the ARP request.
Firstly it will receive the traffic at layer 2
because this is a broadcast and when it reads the layer 3 information
it will see that this is an ARP request for its IP address.
So the router will reply with an ARP reply to PC A ARP request.
The ARP reply is a unicast address so source MAC address is G
the router's MAC address, destination MAC address is A
source IP address is the router's IP address
destination IP address is A IP address.
The hub will once again flood the traffic out of all ports
except the port on which it arrived.
C will drop the frame because it's not destined to itself.
Notice in the frame the destination MAC address is A
but the PCs MAC address is C, so it will drop the frame.
And what’s important to note is that it’s the Network Interface Card
that drops the frame and not the central CPU of the PC.
A will receive the frame and upon a receipt will process the frame
because the destination MAC address is itself.
So at layer 2 the frame is accepted by the NIC or Network Interface Card .
The layer 2 information is strip and forward it to high layer protocols.
Because this is an ARP reply its process by high layer protocols
and the ARP cache is updated with the MAC address of the router, so PC A
now has a mapping saying that IP address 10.1.1.100 uses MAC address G
so this is the important, PC A knows that the IP address
10.1.1.100 is associated with MAC address G.
So the PC can send traffic to the network destined for the remote PC 10.1.2.1
with the source IP address set to 10.1.1.1 itself
but notice please that the source MAC address is the local PC
and the destination MAC address is the router.
The layer 2 frame goes to the router and hence the layer 2
information contains the local segment MAC addresses.
Source MAC address the PC, destination MAC address the router.
The layer 3 information contains the destination IP address
of the remote host and the local PCs IP address.
The hub will flood the frame to both c and G, C will drop the frame
because the destination MAC address is not itself
the router will receive the frame at layer 2
because its destined to its MAC address of G.
It will then strip the layer 2 information
and read the layer 3 information in the packet.
So now let’s look at a practical example
I’m going to capture traffic in Wireshark, so I'll start the capture
I’m gonna clear my ARP cache, so arp-a shows that no entries
are in the ARP cache at the moment and then I’m gonna ping hp.com
notice the DNS resolution has taking place, ICMP message has timing out
because a firewall is blocking the ICMP messages to that server.
So here’s another example, lets ping Google com.
Notice pings are succeeding, so I’ll stop the capture.
HP was using an IP address in the 15 range.
So let’s have a look for that ICMP traffic
so notice there’s an ICMP message to hp.com
and you can see that because the address is 15.
And HP own the 15 IP address range.
We didn’t get a reply from the server but the echo request was sent.
What I’d like you to see please is that at layer 2
the source MAC address is my local pc
but the destination MAC address is my local router.
Notice I can see that this is a Cisco device because the MAC address
is shown as Cisco for the OUI or vendor portion of the address.
We can see that by typing arp-a
notice this MAC address is the MAC address associated with IP address
10.0.0.254 IP config shows us that
that is the IP address of the default gateway.
So the traffic is going from my local PC to hp.com
but it’s being routed by my local router.
At layer 3 we have the local PC's IP address
the destination IP address is hp but at layer 2
the source MAC address is my PC
and the destination MAC address is the local router.
And once again sending the traffic to my local default gateway at layer 2.
I can filter the Wireshark capture to show only ICMP traffic again.
Here’s traffic going to Google so source IP address is my local machine
destination IP address is Google but notice at layer 2
the source MAC address is my local PC
and the destination MAC address is once again the local router.