1

In a given Ethernet frame containing the HTTP GET message can we tell apart whether the MAC address of the destination is of a router or end host?

The link to ethernet-ethereal trace :: https://drive.google.com/open?id=1zdKxyxEz0zXVLX_GWVroZp58YPTuBxm3

  • Is it possible to guess that the mac is of a router using the infomation from the whole trace?Since two different IPs(199.2.53.206(1st TCP protocol) & 192.168.1.1(1st ARP protcol's reply)) have the same mac address in trace. – onk101 Sep 3 '18 at 15:33
3

In a given Ethernet frame containing the HTTP GET message can we tell apart wether the mac address of the destimation is of a router or end host?

Not by the frame alone. However, if the destination IP address is local to the capturing host (=located within the same subnet) then the MAC address is that of the destination host. Destinations outside the host's local subnet require a router, so the destination MAC address will be that of the appropriate gateway.

If you've captured the frame through mirroring/SPAN please replace "capturing host" with "capturing port".

Of course, you can also use the MAC's OUI to make an educated guess which kind node is addressed. Many vendors build different device types though, so you might not be able to distinguish them.

EDIT: When examining a full (or rather lengthy) trace, you can also guess based on the ARP (or NDP) exchanges. Packets destined for local nodes and gateways require a previous ARP for the destination IP. Packets destined for remote nodes are encapsulated by MAC frames targeted for one of the gateways and there's no previous ARP for the destination IP itself. However, this is also possible using multiple IP subnets within the same L2 segment together with static ARP entries - not too common but possible.

  • Is it possible to guess that the mac is of a router using the infomation from the whole trace?Since two different IPs(199.2.53.206(1st TCP protocol) & 192.168.1.1(1st ARP protcol's reply)) have the same mac address in trace. – onk101 Sep 4 '18 at 5:18
  • I've added that line of thought to the answer. – Zac67 Sep 4 '18 at 5:56
  • There is also the possibility of router forwarding on the same subnet Host1->R->Host2, for exotic reasons or more usually mistake. – jonathanjo Sep 4 '18 at 8:48
  • @jonathanjo Good point - that would require a host configuration error / subnet mismatch though (not "the same subnet" for all nodes). – Zac67 Sep 4 '18 at 8:54
  • @Zac .. "believed to be same subnet" ... it's easy to look at one end and think they all have the correct/intended subnet mask. Once it took me three days to find an evil misconfigured unit. – jonathanjo Sep 4 '18 at 9:02
0

The MAC address is probably that of the router. The MAC address of the end host stays inside the boundaries of his LAN. What you do know is that if the end host isn't using some kind of proxy that the IP address in the packet is his, but you are talking about a frame.

If you think of the encapsulation/decapsulation process it will make better sense, since the network packet leaving from the end host's lan (through the router) is decapsulated from the MAC address (network OSI level).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.