I want to understand differences with hosts transmitting data to another host within a local LAN and hosts sending data to another host in a remote LAN. A book I was reading quoted this"

"...understand that routers, which work at Network layer, don't care about where a particular house is located. They're only concerned about where networks are located and the best way to reach them."

Another part says:

"...Each time a packet is sent between routers, the Data link layer uses hardware addressing. Each time a packet is sent between routers, it's framed with control information at the Data Link later. However, that information is stripped off at the receiving router & only the original packert is left completely intact. This framing of the packet continues for each hop until the packet is finally delivered to the correct receiving host."

Self drawn network diagram

Using the diagram above as reference, I have some questions in mind:

  1. Is it correct to say that, when Alice wants to transmit data to Charlie, the process is as such:

    • Alice's packet will contain Alice IP address (SOURCE), and Charlie's IP address (DESTINATION). This info is passed onto the data link layer.
    • At the Data link layer, Alice MAC addresses (SOURCE) and Charlie's MAC address (DESTINATION) are added.
    • The data will be transmitted to SWITCH A. SWITCH A checks the destination MAC address and since SWITCH A knows where Charlie is located, it passes the data to the respective interface that Charlie is connected to.
    • Charlie will inspect the destination MAC address to see if its correct. If it's correct it will pass the data to the network layer
    • At the network layer, the DATA LINK layer information is being stripped off and Charlie check the Destination IP address. If it's correct Charlie will accept the data.

Is that correct?

  1. When Alice wants to send data to a host in a remote LAN, in this case, Bob,

    • Does Alice put the DESTINATION IP ADDRESS as the ROUTER A IP ADDRESS (Router A is the default gateway)? Because Alice does not know the IP Address of Bob, and only the remote router B knows it.

    • Is the destination MAC address the MAC address of BOB's Computer? or MAC address of the interface of switch A that Alice is connected to?

    • Does that mean that when the Data is transmit from Router A to Router B, the MAC Addresses in the data is ignored, and the router cares about the IP address, to know where to route the data to?

I hope my questions make sense. I'm trying to get my fundamental right before going to advance topic. Sorry if my English is bad.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 17:37

2 Answers 2


First off - your English appears to me to be excellent. Secondly your summation of bridging (question 1) and consequently your understanding of the subject are very good. I would probably word some of that slightly different but your summation is fair and it appears that your understanding is good.

Let's make one assumption at this point to keep things simple - this is all Ethernet and IP.

Having said that there are two steps that I would add to your bridging summation that might clear up your understanding of routing (question 2) a little:

  1. when your network stack is handed data to transmit there is a route table look up done (every device on an IP network contains a route table - to see it from a command prompt - on linux type "route", on windows type "route print".) to determine two things:

a) which interface to transmit the data out

b) if the destination is directly reachable or is remote (beyond a router).

  1. Once the route is determined the network stack will ARP for a MAC address.

So when Alice is sending data to Charlie she does a route lookup - it is determined that his machine is directly accessible on the LAN. She then ARPs for his MAC address. Once the route has been determined and the MAC address has been acquired the network stack can then assemble the packet for transmission. This particular conversation as you mentioned only traverses switch A as it inspects the destination MAC.

Now that we have fleshed out question one a little better let's apply some of these concepts to question 2.

When Alice desires to send data to Bob the first step is a route lookup. It is determined that Bob is not on the LAN. Thus the route to Bob is the default route (assuming Router A is configured as such). (As your book points out Router A - and by extension Alice - don't know where Bob is. They only know the general direction - or "route".) So Alice ARPs for Router A. Then assembles the packet with destination IP address(network layer) of Bob and MAC address(datalink layer) of Router A. Upon receiving this packet Router A 1)strips off the MAC address(datalink layer) of Alice 2)does a route lookup 3)ARPs for router B 4)then reassembles the packet with MAC address of Router B. Router B repeats these steps ARPing for Bob and forwards the packet.

So the network layer is assembled at the start - source Alice and destination Bob - and never changes. The datalink layer on the other hand is deleted and reassembled each and every leg of the trip.

  • I appreciate your enligtenment Stephen. I understand it pretty well now. :) Will print this whole conversation out for study reference. Jun 23, 2015 at 17:36

In 1):

  • Alice looks at the dst IP/prefix, and if it deems it the local subnet, will look in her ARP lookup table table for a MAC for Charlie's IP
  • if it has one, data is sent
  • if it doesn't, Alice sends out an ARP broadcast ie: "who has the MAC of Charlie's IP?"
  • Charlie responds with his MAC and data is sent
  • if the MAC data is incorrect, Charlie will never receive the frame

In 2):

  • Alice puts dst address in the IP packet. The src and dst addresses never changes (unless you're doing NAT or other trickery)
  • Alice puts the MAC address of her default gateway into the Ethernet Frame
  • for simplicity sake, we'll just say that Alice's default gateway (rtr A) will have a route in its routing table saying "the subnet Bob is on is through the IP address of router B"
  • rtr A will then use the same MAC lookup scenario for rtr B's IP as Alice's computer did when looking for Charlie, and once found, the packet is sent from rtr A to rtr B
  • the far side of rtr B is on the same subnet as Bob, so the MAC lookup is done again, and finally rtr B sends the packet on to Bob

EDIT: Example for ARP lookup on local subnet.

First, I look in my local machine's ( ARP table and see there's no entry for

$ arp | grep
# no output

So then while listening on the wire with tcpdump (using my local MAC as src and dst (to capture both the outgoing frame and incoming frame)), I ping from my local machine in a different terminal window. The first ping sometimes fails as it has to do the ARP lookup:

$ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.430 ms

In the tcpdump window, you can see what happens after I started the ping:

$ sudo tcpdump -nn -i eth0 arp and ether src a0:d3:c1:0e:73:68 or ether dst a0:d3:c1:0e:73:68

10:23:55.576782 ARP, Request who-has tell, length 28
10:23:55.576950 ARP, Reply is-at 00:21:9b:65:c9:b9, length 46

The first line after the command starts, my computer sends out a "who-has tell". is my computer. Thereafter, the remote computer responds back with its MAC address " is-at ..."

After the lookup and reply, my local ARP table is updated. This entry will stay present and won't need to do another lookup for that IP's MAC until the ARP cache timeout occurs for that IP (default is 60 seconds on Ubuntu):

$ arp -a | grep
? ( at 00:21:9b:65:c9:b9 [ether] on eth0
  • Stevieb, Thanks for your reply. I appreciate it. In the first scenario, does Alice uses ARP to look for CHARLIE'S MAC ADDRESS using CHARLIE'S IP ADDRESS or uses CHARLIE'S IP ADDRESS to look for CHARLIE'S MAC ADDRESS? Jun 23, 2015 at 16:09
  • I've updated my answer. Check to see if the extra info helps you and let me know.
    – stevieb
    Jun 23, 2015 at 16:32
  • Thank you. I understand now. One question: Your machine only manage to retrieve the MAC address of because you happen to know the IP address of the other machine , and because you manually invoke the ping, replies and thus your machine is able update its ARP table. What if I just set up a fresh new computer network. 2 hosts connected to a same switch. In this case, with the machines not knowing each other IP addresses, how do they perform ARP? Unless they have some form of broadcasting mechanism? Jun 23, 2015 at 17:32
  • Like, someone just move into this neighbourhood and go onto each neighbour's house to intro himself? Jun 23, 2015 at 17:34
  • ARP is broadcast ;) To look up a MAC, you pretty much need to know the IP address. When connected to a new network, one way to sweep and see who is available is nmap: nmap -sP This will send a ping to every one of those IPs (1-255), and if the MAC for that IP isn't known, the ARP process begins (for each IP at a time). Again, ARP does broadcast, so if your machine doesn't know your neighbor's (MAC)address, it puts the request for the MAC on the wire openly for the IP in question, so EVERYONE sees it, and the host who owns the IP responds back directly.
    – stevieb
    Jun 23, 2015 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.