3

Using Wireshark to capture ICMP packets (Windows) using ping to google.com, I can see the source-MACAddr of the ICMP Echo replies is not the same as the MAC address of my direct router (which is the dest-MACAddr of the icmpEchoRequest).

AFAIK, the MAC address of a packet sent to my PC should belong to my direct router, so I wonder where did that MAC address come from?

Update :

My router, named All-HSRP-routers_06 (Wireshark), has its MACAddr as 00-00-0c-07-ac-06 (I got it from arp -a for the MAC address of the default gateway's IP address).

The mentioned strange MAC address is 00-25-45-1d-14-21, from a router named CiscoInc_1d:14:21 (Wireshark).

Another interesting fact is that whatever IP address I ping to, the source MAC address of icmp-echo-reply is always the strange one, but not my router's MAC address.

Improve this question

2 Answers 2

Reset to default
8

You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, 0000.0C07.ACxx, which is the MAC address range for HSRP. The 06 on the end of the MAC address is the HSRP group number.

HSRP uses virtual IP and MAC addresses. You send to the virtual addresses to transit the router, but anything coming back will have the actual router interface MAC address. Depending on how your network is configured, you may sometimes get a different MAC address because the return traffic is from the other router.

The MAC address you are seeing is the real MAC address of the router's interface.

Improve this answer
0

I hope you are pinging to the router's IP address. Can you share the router model#? Typically, the mac-address of the interface through which the router sends out ICMP echo reply will be the SRC MAC of that packet. If that interface is tagged to multiple VLANs, then the VLAN MAC (which might be different than interface MAC) will be used in the response packet.

Also, make sure there is no duplicate IP in the network. If there is duplicate, you may be receiving the response from another host.

Improve this answer
1
  • My PC is in a normal network (without any VLAN) & I pinged to an internet address not my router's one. I can be sure that there's no IP duplication.
    – David Tran
    Commented Apr 6, 2016 at 5:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.