I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it showed the ip address and cisco_ followed by the start of what appears to be a mac address, e.g. cisco_fa:dd:b8, how come it shows cisco? Is this because its a remote host? As when I ping PC 2 from PC 1, cisco isn't displayed it just displays the ip address and mac address.

enter image description here

  • At what point in your network did you do the capture?
    – Ron Trunk
    Mar 5 '19 at 19:04
  • It might be helpful to put the Capture in Cloudshark and put a link here.
    – Ron Trunk
    Mar 5 '19 at 19:06

If I understand correctly, PC3 is on the other side of a router from PC1 and PC2. Layer-2 addresses are only relevant on the same network.

When a host is sending to the same network, the destination layer-2 (MAC) address will be that of the destination host.

A host sending to a different network will use the destination layer-2 (MAC) address of its configured gateway because that is the destination on the same network.

A router will strip off the layer-2 frame in order to route the layer-3 packet. The router will then build a new frame for the new interface, and the source layer-2 (MAC) address will be that of the router on the sending router interface.

  • but why does it start with cisco_
    – The_Bear
    Mar 5 '19 at 20:12
  • Because it is a Cisco router, and that is simply replacing the OUI with that to explain that it is a Cisco device. You see that in Wireshark with well-know vendors.
    – Ron Maupin
    Mar 5 '19 at 20:14
  • So does that mean that it is showing the MAC address for router 2’s default gateway as PC 3 is connected to router 2? Not router 1?
    – The_Bear
    Mar 5 '19 at 23:21
  • You did not provide a diagram or configurations, so I cannot answer that.
    – Ron Maupin
    Mar 6 '19 at 3:09
  • I've added diagram to show you
    – The_Bear
    Mar 6 '19 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.