Using Wireshark to capture ICMP packets (Windows) using ping to
google.com, I can see the
source-MACAddr of the ICMP Echo replies is not the same as the MAC address of my direct router (which is the
dest-MACAddr of the
AFAIK, the MAC address of a packet sent to my PC should belong to my direct router, so I wonder where did that MAC address come from?
My router, named
All-HSRP-routers_06 (Wireshark), has its MACAddr as
00-00-0c-07-ac-06 (I got it from
arp -a for the MAC address of the default gateway's IP address).
The mentioned strange MAC address is
00-25-45-1d-14-21, from a router named
Another interesting fact is that whatever IP address I ping to, the source MAC address of
icmp-echo-reply is always the strange one, but not my router's MAC address.