Dev Learning Lab

The labs on this site need JavaScript to run. The same content is written out below.

Learn › Networking › Addresses and names

Switches and routers

If the destination IP is the server, why is the frame sent to the router's MAC address?

A frame for a device on the same network is sent directly to that device's MAC address, and a switch uses that address to deliver it. A device on another network cannot be reached directly, so the sender hands the frame to its gateway (a router). Each time the packet passes a router, the MAC addresses in the frame are written anew, but the IP addresses stay the same and the TTL goes down by 1.

Conceptual model · A conceptual model of the rules in RFC 826, 791, 1122, and 1812. It could not be checked against real equipment, so it was checked in 18 combinations against values calculated from the same rules by a different method

Concepts in this lab

MAC address and ARP
A MAC address is a 48-bit address attached to each network device, such as a network card, and it is used within a network to say to whom a frame should be handed. While an IP address points to the final destination, a MAC address points to the device that will take the frame over next. ARP is the protocol that finds the MAC address of the owner of an IP address from that IP address. A request that says "whoever owns this IP address, tell me your MAC address" is sent to every device on the network, only the owner answers, and the result is kept for a while in the ARP cache. An ARP request cannot cross a router, so the MAC address of a device on another network cannot be found.
Switch and router
A switch is a device that connects the devices in one network, and it looks at the destination MAC address of the frame and, if it knows which port that device is connected to, sends the frame out only through that port. It does not look at IP addresses and does not change the contents of the frame. A router is a device that connects different networks, and it decides where to hand a packet next by looking at the destination IP address of the packet and its routing table. When a packet passes a router, the frame is built anew and the MAC addresses change, but the IP addresses usually stay the same (NAT, which changes addresses as a home router does, is an exception) and the TTL goes down by 1. A home router combines a router, a switch, and a wireless access point in one machine.
Default gateway
The default gateway is the address of the router to which a computer hands the packets it sends outside its own network. The computer compares the destination IP address with its own IP address using the subnet mask. If they are on the same network, it sends the packet directly to the other device, and if not, it sends it to the default gateway. In that case, the destination IP address of the packet is left as the original destination, and only the destination MAC address of the frame is set to that of the gateway. If the default gateway is set wrong, the computer can communicate with devices on the same network but cannot get out to the internet.
TTL of an IP packet
The TTL of an IP packet is a number in the header that gives a limit on the number of routers the packet can pass. The sender sets the initial value, and a router decreases it by 1 each time it forwards the packet. When it reaches 0, the router discards the packet and sends an ICMP "Time Exceeded" message back to the sender. It exists to prevent a packet from circling between routers forever because of a wrong path setting. traceroute is a tool that sends packets with the TTL raised one at a time from 1 and checks the routers that respond, in order. It has the same name as the TTL (how long data is kept) in caches and DNS, but it is a different concept.
OSI model
A model that divides the process of network communication into seven layers by role. From the bottom, they are the physical, data link, network (IP), transport (TCP/UDP), session, presentation, and application (HTTP) layers. Each layer does its own job by using the functions of the layer directly below it. It is the reference for calling the location of a device or a problem "Layer N".

Try these

Running with the default settings

  1. Decision of PC A: it compares the destination IP 192.168.2.30 with its own IP 192.168.1.10 using the subnet mask 255.255.255.0. The first three numbers, where the mask is 255, differ (PC A is on 192.168.1 and the destination is on 192.168.2), so they are on different networks. PC A cannot reach it directly, so it decides to hand the packet to the default gateway in its settings, 192.168.1.1 (router R1).
  2. ARP request from PC A: to send a frame, it needs the MAC address of the device that will take the frame over, but PC A does not know the MAC address of 192.168.1.1 yet. It sends an ARP request that says "Whoever owns IP address 192.168.1.1, tell me your MAC address," with the destination MAC set to "everyone" (broadcast). The switch sends it out to every device on network A. The IP address being asked about is not that of Server C but that of the gateway. An ARP request cannot cross a router, so the MAC address of a device on another network cannot be found, and there is no need to find it.
  3. ARP reply: only Router R1, the owner of that IP address, answers PC A. The content of the answer is "My MAC address is 00:00:5E:00:53:11." PC B also received the request, but it does not answer because the IP address is not its own. PC A writes the address it found in its ARP cache and does not ask again for a while.
  4. PC A sends the frame: in the frame header it writes the destination MAC …:11 (Router R1) and the source MAC …:0A (PC A), and inside the frame it puts the IP packet (source IP 192.168.1.10, destination IP 192.168.2.30, TTL 64). The destination IP is that of Server C, but the destination MAC is that of router R1. The IP address points to the final recipient, and the MAC address points to the device that takes the frame over on this hop.
  5. Switch: it looks only at the destination MAC address of the frame and sends it out only through the port to which that device (Router R1) is connected. It does not open the IP packet inside, and it does not modify the frame.
  6. Router R1 receives it: the destination MAC address of the frame is its own, so it accepts the frame and removes the outer part that holds the MAC addresses. The destination IP of the IP packet inside (192.168.2.30) is not its own address. This is a packet that has to be forwarded elsewhere. A switch passes frames on by looking only at the MAC address, but a router looks at the IP address like this to choose the path.
  7. Router R1 handles the TTL: before forwarding, it decreases the TTL by 1 (64 → 63). The TTL is a limit on the number of routers a packet can pass. Even if a wrong path setting makes a packet circle between routers, the TTL eventually reaches 0 and the packet disappears.
  8. Router R1 finds the way and uses ARP: In its routing table, the router finds that 192.168.2.0/24, which contains the destination IP, is network B, directly connected to this router. It can hand the packet straight to Server C. It sends an ARP request on network B to find the MAC address of 192.168.2.30 (…:0C).
  9. Router R1 forwards it: it puts the same IP packet in a new frame. In the frame header, both addresses have changed: the destination MAC is …:0C (Server C) and the source MAC is …:12 (R1, network B side). The source IP 192.168.1.10 and the destination IP 192.168.2.30 inside are unchanged, and only the TTL is now 63.
  10. Server C receives it: the destination MAC address of the frame is its own, and the destination IP of the packet inside is its own address too. The packet has arrived. The TTL on arrival is 63. After passing 1 router, the TTL went down by 1 from the initial value 64.

Result of this run

Code

// Network settings of PC A
const me      = '192.168.1.10';
const mask    = '255.255.255.0';   // the first three numbers, where the mask is 255, identify the network
const gateway = '192.168.1.1';     // the door to other networks (router R1)

// The IP packet to send
const packet = { from: '192.168.1.10', to: '192.168.2.30', ttl: 64 };   // sent to Server C

// Rule of the sending computer: whose MAC address should this frame be sent to?
const nextHop = sameNetwork(me, packet.to, mask) ? packet.to : gateway;
const frame = { toMac: arp(nextHop), fromMac: myMac, payload: packet };

// Rule of a router: when it receives a packet that is going somewhere else
packet.ttl -= 1;
if (packet.ttl === 0) discardAndReportTimeExceeded(packet);   // discard it and tell the sender
else forwardInNewFrame(packet);    // write only new MAC addresses and send it on to the next hop. The IP addresses stay the same

Assumptions of this model

This is a conceptual model that puts the rules of the standards documents into code, not the result of running real equipment. This one PC cannot build a path through a switch and two routers, so it could not be checked by execution. Instead, the results of the model were checked against a calculation that applies the same rules in a different way (each device holds an IP address, a mask, a routing table, and an ARP table, and the packet is handed from device to device) in 18 combinations. The documents used as the basis: that the sending computer uses the mask to decide whether the destination is on the same network and then sends directly or via the gateway is Section 3.3.1.1 of RFC 1122; ARP, which finds a MAC address from an IP address, is RFC 826; the meaning of TTL is Section 3.2 of RFC 791; that a router decreases the TTL when it forwards a packet, discards the packet when it reaches 0, and sends an ICMP Time Exceeded message is Section 5.3.1 of RFC 1812 and RFC 792; and that a receiving computer accepts a packet even if its TTL is small is Section 3.2.1.7 of RFC 1122. The way a switch forwards by MAC address is what IEEE 802.1D describes. Simplifications: networks B and C also have switches, but they are not drawn; how a switch learns which MAC address is behind which port, the router recalculating the checksum of the IP header after it decreases the TTL, and network address translation (NAT) are not covered. When a packet passes a home router, the source IP address also changes because of NAT. The IP addresses are in the private range (192.168.x.x), and the MAC addresses are values from the range reserved for documentation (RFC 7042, now RFC 9542), not addresses of real devices. The initial TTL differs from one operating system to another.

Previous lab: IP addresses and subnets · Next lab: Sockets and ports

Concepts in this lab

What this lab shows

Settings

Code


      
    


    

      
Diagram

      

      

    


    

      

      

      

    


  


  

    

      
Run comparison

      

      

    

    

      
Try these