I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it showed the ip address and cisco_ followed by the start of what appears to be a mac address, e.g. cisco_fa:dd:b8, how come it shows cisco? Is this because its a remote host? As when I ping PC 2 from PC 1, cisco isn't displayed it just displays the ip address and mac address.
If I understand correctly, PC3 is on the other side of a router from PC1 and PC2. Layer-2 addresses are only relevant on the same network.
When a host is sending to the same network, the destination layer-2 (MAC) address will be that of the destination host.
A host sending to a different network will use the destination layer-2 (MAC) address of its configured gateway because that is the destination on the same network.
A router will strip off the layer-2 frame in order to route the layer-3 packet. The router will then build a new frame for the new interface, and the source layer-2 (MAC) address will be that of the router on the sending router interface.