So when sending traffic from 1 subnet to another subnet
the layer 3 headers contain the source host IP address
and the destination host IP address.
But at layer 2 the source MAC address is the local host
and the destination MAC address is the local router on the local segment.
When the frame gets to the router the router will strip
the layer 2 headers and then read the layer 3 headers
to determine what to do with the traffic.
So the destination IP address is 10.1.2.1 the router will firstly check
to see if that’s a local IP address on the router
and in this case it’s not, the router has these IP addresses.
So its check it’s routing table to determine
if it knows where the destination IP address is
This IP address 10.1.2.1 is on subnet 10.1.2.0 which is out of F0/1.
The router therefore knows it needs to send the traffic to host
10.1.2.1 out of F0/1 it then checks its ARP cache
to see if it has an entry for 10.1.2.1
In this case let’s assume the router doesn’t have an ARP entry
mapping IP address 10.1.2.1 to MAC address B, so it doesn’t know that.
So to find that out it needs to send a broadcast unto the local segment
requesting the MAC address of IP address 10.1.2.1
so it will send out an ARP request message, the hub will flooded out
of its ports and both B and D will receive the frame.
D will receive the frame at layer 2 because its broadcast
but at higher layers it will drop the message
because it's an ARP request for another devices IP address.
So host D drops the frame, but host B will receive at it
layer 2 send it to high layer protocols, high layer protocols will see
that this is an ARP request for the local IP address of this host.
So PC B will process the ARP request
and send back an ARP reply.
The ARP reply will be sent to the hub with source MAC address of B
destination MAC address of the router, the routers is the device
that requested the IP address of the PC and the MAC address
is on each interface of a router are different.
In this case the MAC address used was H
so the PC will reply back to that MAC address, so source MAC address is B
destination MAC address is H, source IP address is 10.1.2.1
destination IP address is 10.1.2.100, the IP address
and MAC address of the routers F0/1 is used in the reply from PC B
when the hub receives the traffic it will flood it out of all of its ports
D will drop the frame the router however will process the traffic
because the MAC address is its local MAC address.
So the routers network interface card
will receive the traffic at layer 2, it will then process the layer 3
and layer 4 information and it will update its local ARP cache
stating that IP address 10.1.2.1 as MAC address B.
Now that the ARP cache is updated the router can send
the original ping traffic to host B.
So when the frame arrived at the router from host A
it had a source MAC address of A, destination MAC address of G
source IP address of 10.1.1.1 destination IP address of 10.1.2.1
when it now sends that traffic out of F0/1, it rewrites the MAC address entries
So the source MAC address is H, the local router's interface
the destination MAC address is B
the host that the router wants to communicate with.
the source IP address is still the IP address of host A
and the destination IP address is still the IP address of host B.
It’s really important to remember that when traversing a router
or a layer 3 switch, so for example when moving from 1 VLAN to another
the layer 2 information is rewritten, the layer 3 information is left the same
but every time traffic hops across a router
or is sent from 1 VLAN to another VLAN
the layer 2 information is rewritten in the frame
When that traffic is received by the hub, it will flood it out of all ports
D will drop the frame because the destination MAC address is B and not D.
B will receive the frame at layer 2 because it's destined to itself
and then it will process the layer 3 and layer 4 information.
In this case it’s an ICMP echo message sent from A to B.
so B is going to one to reply with an echo reply message.
So B will reply with an echo reply but please notice that the echo reply
is going to a destination IP address of 10.1.1.1 which is host A
the source Mac address is B, the local PC
but the destination MAC address is the router, device B is sending
the traffic to its default gateway because it would have also done
a logical end on the IP address and subnet and it would have worked out
that IP address 10.1.1.1 is on a different subnet to itself.
So it’s gonna send the traffic to its default gateway
and in this case we would have configured the PC
with the default gateway of 10.1.2.100
The hub will flood the traffic out of all ports
D will drop the frame once again because it’s not destined to itself.
The router will process the frame at layer 2
because the destination MAC address is its local MAC address.
It will then strip the layer 2 information and read the layer 3 information
to determine if it knows where the destination address is.
In this case 10.1.1.1 is in subnet 10.1.1.0/24
and that subnet is directly connected to F0/0 on the router.
So the destination IP address is in a subnet that’s known by the router
and it now knows out of which interface to send a traffic.
So the router knows that it needs to forward this packet out of interface F0/0.
The router will then rewrite the layer 2 headers.
So the destination MAC address is A.
The source MAC addresses is G,
which is the MAC address of F0/0 on the router.
The layer 3 information is left the same but the layer 2 headers are rewritten.
The router forwards the frame to the hub.
When a hub receives the traffic it will flood it out of all ports.
C will drop the frame because it’s not destined to it.
A will receive the frame because the destination MAC address is itself.
It will then process the layer 2 information
strip the layer 2 headers, forward it to higher layer protocols.
The higher layer protocols will process the layer 3
and layer 4 and upper layers and the ping will succeed in this example.
Now in some cases you'll notice that when you ping a device
the first ping fails and that’s typically because of the ARP request
and replies that need to take place to populate the ARP caches
of devices between the source and destination device.
So don’t be concerned if you lose the first ping when pinging a remote device.
It’s probably because the ARP cache is have been populated
by the devices involved in the communication.
The important thing to remember is that when you ping across a router
or a layer 3 switch, the layer 2 information is updated at each hop
but the layer 3 information remains the same
unless Network Address Translation or NAT is used.
When you move from 1 VLAN to another VLAN on a layer 3 switch
or move from 1 interface to another on a router
the layer 3 information is not changed, but the layer 2 headers are rewritten.
So in summary a router is a layer 3 device, it makes routing decisions
based on IP addresses and it rewrites MAC addresses
layer 3 switches also operate at this layer.
The layer 3 switch has layer 2 capability as well as layer 3 capability.
When you send traffic from VLAN 10 to VLAN 20 for example
the layer 2 frames are rewritten.
The traffic is logically going through a router as the layer 3 switch
implements routing capability and therefore the layer 2 MAC addresses
are rewritten but the layer 3 information remains the same.