Is it possible to perform a Layer 2 (MAC address) traceroute?

Question

I understand the difference between layer2 & layer3 and MAC & IP. I understand address resolution protocol, etc. But is there any way to do a traceroute that will show Layer 2 information? For instance, I'd like to discover the MAC address of the nearest switch on the far side of a router.

So, it goes: Desktop→Router→Switch, and I want to check the MAC of the Switch. Layer 2 & 3 information all the way to 8.8.8.8 would be nice, if possible, but I don't like my chances.

I can't see how it could be achieved, but I don't know everything. Just because I can't think of a way to do it, doesn't necessarily mean it can't be done somehow.

After all Layer 3 packets are encapsulated in layer 2 frames, perhaps there's a way to retain the Layer 2 headers in the opposite direction, instead of being stripped by the router somehow?

Answer 1

But is there any way to do a traceroute that will show Layer 2 information?

Short answer: no.

Longer answer: traceroute exploits IP's TTL feature. There is no such concept in Ethernet, hence no traceroute.

For instance, I'd like to discover the MAC address of the nearest switch on the far side of a router.

A switch doesn't necessarily have a MAC address (in the VLAN connected to the router). Using LLDP or CDP, you could just ask the router which adjacent devices it has discovered. With a managed switch you can ping it (or send just any kind of packet to its IP address) and check the router's ARP table.

Layer 2 & 3 information all the way to 8.8.8.8 would be nice,

L3/IP is no problem (traceroute) with hops supporting ICMP TTL exceeded. With L2 there's no way.

After all Layer 3 packets are encapsulated in layer 2 frames, perhaps there's a way to retain the Layer 2 headers in the opposite direction, instead of being stripped by the router somehow?

No. A router decapsulates the packet and dumps the frame when it's routing. If the router has a packet capturing feature you could use that to capture from the far side, of course; there may also be alternative, similar methods (sFlow possibly). Without such control over the router, there's no way.

Answer 2

Layer 2 information is stripped off and thrown away at every layer 3 ingress interface. A completely new layer 2 header is added on the outgoing interface. You're asking a router to do something completely different.

Also remember that not every layer 2 link has MAC addresses.

Answer 3

There are some problems with your idea.

Traceroute works because layer-3 packet have a TTL that gets reduced by a router, and the router is supposed to send back an ICMP message when the TTL expires. Traceroute sends a packet with a TTL of 1, so the first router expires the TTL and sends back an ICMP message, then traceroute sends a packet with a TTL of 2, so the second router expires the TTL and sends back a message, etc.

Switches are transparent devices that do not alter the layer-2 frames in any way (except adding or removing VLAN tags on trunk links), and ethernet has nothing like a TTL field.

Yes, layer-3 devices, like routers, strip off the layer-2 frame to forward the packet. That is necessary because the layer-3 device must build a new frame for the next interface, which could be a completely different protocol that uses different addressing, or no addressing at all. Even if the next interface is ethernet, the frame on the first LAN has no use on the second LAN because the MAC addresses do not exist on the second LAN.

Remember that the whole world is not ethernet. In fact, there are more devices being shipped with Wi-Fi interfaces than with ethernet interfaces.

Answer 4

L2 can be traced with Cisco - provided CDP is enabled. have a look at Cisco's L2 traceroute feature.

What you're likely looking for is the mac address which you can find via the ARP table on the router. Assuming its your router, log onto it and you should be able to find the FIB of the the device specifying that.