OSI layer : Ethernet and IP address

Question

I want to understand differences with hosts transmitting data to another host within a local LAN and hosts sending data to another host in a remote LAN. A book I was reading quoted this"

"...understand that routers, which work at Network layer, don't care about where a particular house is located. They're only concerned about where networks are located and the best way to reach them."

Another part says:

"...Each time a packet is sent between routers, the Data link layer uses hardware addressing. Each time a packet is sent between routers, it's framed with control information at the Data Link later. However, that information is stripped off at the receiving router & only the original packert is left completely intact. This framing of the packet continues for each hop until the packet is finally delivered to the correct receiving host."

Using the diagram above as reference, I have some questions in mind:

1. Is it correct to say that, when Alice wants to transmit data to Charlie, the process is as such:

   • Alice's packet will contain Alice IP address (SOURCE), and Charlie's IP address (DESTINATION). This info is passed onto the data link layer.
   • At the Data link layer, Alice MAC addresses (SOURCE) and Charlie's MAC address (DESTINATION) are added.
   • The data will be transmitted to SWITCH A. SWITCH A checks the destination MAC address and since SWITCH A knows where Charlie is located, it passes the data to the respective interface that Charlie is connected to.
   • Charlie will inspect the destination MAC address to see if its correct. If it's correct it will pass the data to the network layer
   • At the network layer, the DATA LINK layer information is being stripped off and Charlie check the Destination IP address. If it's correct Charlie will accept the data.

Is that correct?

2. When Alice wants to send data to a host in a remote LAN, in this case, Bob,

   • Does Alice put the DESTINATION IP ADDRESS as the ROUTER A IP ADDRESS (Router A is the default gateway)? Because Alice does not know the IP Address of Bob, and only the remote router B knows it.

   • Is the destination MAC address the MAC address of BOB's Computer? or MAC address of the interface of switch A that Alice is connected to?

   • Does that mean that when the Data is transmit from Router A to Router B, the MAC Addresses in the data is ignored, and the router cares about the IP address, to know where to route the data to?

I hope my questions make sense. I'm trying to get my fundamental right before going to advance topic. Sorry if my English is bad.

Answer 1

First off - your English appears to me to be excellent. Secondly your summation of bridging (question 1) and consequently your understanding of the subject are very good. I would probably word some of that slightly different but your summation is fair and it appears that your understanding is good.

Let's make one assumption at this point to keep things simple - this is all Ethernet and IP.

Having said that there are two steps that I would add to your bridging summation that might clear up your understanding of routing (question 2) a little:

1. when your network stack is handed data to transmit there is a route table look up done (every device on an IP network contains a route table - to see it from a command prompt - on linux type "route", on windows type "route print".) to determine two things:

a) which interface to transmit the data out

b) if the destination is directly reachable or is remote (beyond a router).

2. Once the route is determined the network stack will ARP for a MAC address.

So when Alice is sending data to Charlie she does a route lookup - it is determined that his machine is directly accessible on the LAN. She then ARPs for his MAC address. Once the route has been determined and the MAC address has been acquired the network stack can then assemble the packet for transmission. This particular conversation as you mentioned only traverses switch A as it inspects the destination MAC.

Now that we have fleshed out question one a little better let's apply some of these concepts to question 2.

When Alice desires to send data to Bob the first step is a route lookup. It is determined that Bob is not on the LAN. Thus the route to Bob is the default route (assuming Router A is configured as such). (As your book points out Router A - and by extension Alice - don't know where Bob is. They only know the general direction - or "route".) So Alice ARPs for Router A. Then assembles the packet with destination IP address(network layer) of Bob and MAC address(datalink layer) of Router A. Upon receiving this packet Router A 1)strips off the MAC address(datalink layer) of Alice 2)does a route lookup 3)ARPs for router B 4)then reassembles the packet with MAC address of Router B. Router B repeats these steps ARPing for Bob and forwards the packet.

So the network layer is assembled at the start - source Alice and destination Bob - and never changes. The datalink layer on the other hand is deleted and reassembled each and every leg of the trip.

Answer 2

In 1):

• Alice looks at the dst IP/prefix, and if it deems it the local subnet, will look in her ARP lookup table table for a MAC for Charlie's IP
• if it has one, data is sent
• if it doesn't, Alice sends out an ARP broadcast ie: "who has the MAC of Charlie's IP?"
• Charlie responds with his MAC and data is sent
• if the MAC data is incorrect, Charlie will never receive the frame

In 2):

• Alice puts dst address in the IP packet. The src and dst addresses never changes (unless you're doing NAT or other trickery)
• Alice puts the MAC address of her default gateway into the Ethernet Frame
• for simplicity sake, we'll just say that Alice's default gateway (rtr A) will have a route in its routing table saying "the subnet Bob is on is through the IP address of router B"
• rtr A will then use the same MAC lookup scenario for rtr B's IP as Alice's computer did when looking for Charlie, and once found, the packet is sent from rtr A to rtr B
• the far side of rtr B is on the same subnet as Bob, so the MAC lookup is done again, and finally rtr B sends the packet on to Bob

EDIT: Example for ARP lookup on local subnet.

First, I look in my local machine's (10.0.48.1) ARP table and see there's no entry for 10.0.0.7:

$ arp | grep 10.0.0.7
# no output

So then while listening on the wire with tcpdump (using my local MAC as src and dst (to capture both the outgoing frame and incoming frame)), I ping 10.0.0.7 from my local machine in a different terminal window. The first ping sometimes fails as it has to do the ARP lookup:

$ ping 10.0.0.7
PING 10.0.0.2 (10.0.0.7) 56(84) bytes of data.
64 bytes from 10.0.0.7: icmp_seq=1 ttl=64 time=0.430 ms
^C

In the tcpdump window, you can see what happens after I started the ping:

$ sudo tcpdump -nn -i eth0 arp and ether src a0:d3:c1:0e:73:68 or ether dst a0:d3:c1:0e:73:68

10:23:55.576782 ARP, Request who-has 10.0.0.7 tell 10.0.48.1, length 28
10:23:55.576950 ARP, Reply 10.0.0.7 is-at 00:21:9b:65:c9:b9, length 46

The first line after the command starts, my computer sends out a "who-has 10.0.0.7 tell 10.0.48.1". 10.0.48.1 is my computer. Thereafter, the remote computer responds back with its MAC address "10.0.0.7 is-at ..."

After the lookup and reply, my local ARP table is updated. This entry will stay present and won't need to do another lookup for that IP's MAC until the ARP cache timeout occurs for that IP (default is 60 seconds on Ubuntu):

$ arp -a | grep 10.0.0.7
? (10.0.0.7) at 00:21:9b:65:c9:b9 [ether] on eth0