Routing and MAC addresses

Unanswered Question
Jan 29th, 2009
User Badges:

When a packet that is being routed moves from one router's serial interface to another router's serial interface, what MAC addresses are used for the source and destination?


Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (4 ratings)
Loading.
ex-engineer Thu, 01/29/2009 - 09:25
User Badges:

Let me rephrase that, which source and destination L2 addresses are used if that serial link is a point to point connection (like HDLC encap)?


Of course MAC addresses would be used if the L2 technology of that router to router connection was ethernet, so my question was poorly worded.


I assume that if the router to router connection were a frame relay link, the L2 source and destination addresses of the IP datagram would be the DLCIs, correct?





Istvan_Rabai Thu, 01/29/2009 - 09:48
User Badges:
  • Gold, 750 points or more

Hi Joe,


As far as I remember there is some number in the HDLC frame as a layer2 address, but it has no significance on point-to-point links.


When you send a frame on a point-to-point link, only the device on the other end of the link can receive it.


The layer2 addresses, like mac-address and DLCI are significant only on multiaccess networks.


Cheers:

Istvan

ex-engineer Thu, 01/29/2009 - 10:14
User Badges:

Hi, Istvan:


"The layer2 addresses, like mac-address and DLCI are significant only on multiaccess networks."


True, but nonetheless, the data-link layer includes its own information that it appends to an IP datagram. More specifically, the IP datagram is encapsulated by the data-link layer/L2 frame, which has its own header. That header includes source and destination L2 address information for that layer. Something has to be placed in those fields to satisfy the requirement.


Also, frame relay is indeed a multiaccess network, which makes the L2 address scheme all the more significant. I do believe that with frame relay, the source and destination address fields for the header of that Frame Relay frame are populated with the local and remote DLCIs for that connection.


But I am still at a loss when it comes to HDLC. What source and destination addresses populate the corresponding fields when HDLC encapsulation is used?

Istvan_Rabai Thu, 01/29/2009 - 11:33
User Badges:
  • Gold, 750 points or more

Hi Joe,


I have now made a packet capture specifically for you:


The HDLC header is 4 bytes in length.


The 1st byte is the layer2 destination address: 0x0F (for all packets and for both directions).

The 2nd byte is 0x00.

The 3rd and 4th bytes contain the protocol (next header information), in this case IP: 0x0800.


I hope this helps you.


Cheers:

Istvan

Edison Ortiz Thu, 01/29/2009 - 11:47
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

In the context of Cisco HDLC, it uses SLARP (Serial Line ARP) between the end-points and no Ethernet Frame information (MAC Address) is send on the packet. It's pure IP src-dst. Attached you will find the differences between a ping done in a LAN segment vs a ping done in a cHDLC connection (download WireShark if you want to view its detail).


Additional information on cHDLC can be found on this condensed document:


http://en.wikipedia.org/wiki/Cisco_HDLC


HTH,


__


Edison.





Attachment: 
ex-engineer Thu, 01/29/2009 - 12:01
User Badges:

Hi, Edison:


Thanks for your input. I do believe that you may be a bit confused regarding my question. SLARP is a subset of cHDLC that allows a router to configure its own IP address for an interface configured with HDLC encapsulation. Within the lexicon of SLARP, the word "address" refers to a 32-bit L3/IP address.


My question involved the L2 address(es) that a router inserts in the address fields of a L2 frame's header - with a particular concern with an HDLC header. As I can see from Istvan's sniffer output, as well as the link you sent me, the L2 address field will be 0x0F for Unicast and 0x8F for Broadcast HDLC packets.


The reason I even began thinking of this was that I was refreshing my memory on how a packet traverses a routed IP network and the manner in which the packet is handled hop-by-hop by the routers. I knew that the L3 source and destination addresses will not change (barring NAT or some other special circumstance), but the L2 addresses will as they traverse the network hop-by-hop -- datalink hopping, if you will. It then dawned on me that serial interfaces do not have MAC addresses - that MAC addresses are associated with Ethernet.


I needed to know how the router resolves the IP address next-hop in its routing table with a L2 next hop for it to use in its L2 header as it forwards the packet to the next hop router. For Ethernet interfaces, the IP addresses resolves to a MAC address, but what about serial interfaces, I thought.


Hence my question...


Am I making sense?


Thanks



Edison Ortiz Thu, 01/29/2009 - 12:18
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

Am I making sense?


Not really.


On LAN segments, the MAC is needed in order to know where to send the packets to. It provides a unique identifier for each device in a LAN segment.


On a Point-to-Point WAN segment, there is only ONE device at the remote send. Why the packet overhead?


__


Edison.

ex-engineer Thu, 01/29/2009 - 12:33
User Badges:

Edison:


"Why the packet overhead?"


I don't create the protocols - I only try to understand how they work. :-)


HDLC is a point-to-point WAN technology that does utilize an L2 address field, as the very link you gave me points out. The address field is not the address of the sending or receiving node, but is used more as an identifier of the type of packet being sent -- unicast or broadcast. Nonetheless, the field exists and it must be populated. With what? That was my question.


Also, Frame Relay, which has its roots in LAPD, and can be configured as a point-to-point connection, also utilizes an L2 address field in the header. The Frame Relay header will include an address field in which the DLCI is placed, regardless of the fact that the router may be directly connected to another router. The reason, I imagine, is that the underlying assumption of FR is that it is an NBMA technology that can be implemented as a point-to-point.


In short, all data link layer technologies utilize an address scheme. And that address scheme is used to forward IP packets from hop to hop over a routed network.



Edison Ortiz Thu, 01/29/2009 - 12:42
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

HDLC is a point-to-point WAN technology that does utilize an L2 address field, as the very link you gave me points out.


And Layer2 address field does not make use of MAC address hence my comment on the packet overhead. The MAC address information isn't needed. It's a point-to-point link.


Also, Frame Relay, which has its roots in LAPD, and can be configured as a point-to-point connection, also utilizes an L2 address field in the header. The Frame Relay header will include an address field in which the DLCI is placed, regardless of the fact that the router may be directly connected to another router. The reason, I imagine, is that the underlying assumption of FR is that it is an NBMA technology that can be implemented as a point-to-point.


But you will notice, when implementing point-to-point subinterfaces in Frame-Relay, you don't need to map an IP to a DLCI. You do need to map an IP to a DLCI on multi-point frame-relay either via reverse ARP or static.


HTH,


__


Edison.


ex-engineer Thu, 01/29/2009 - 12:54
User Badges:

Edison:


And Layer2 address field does not make use of MAC address hence my comment on the packet overhead. The MAC address information isn't needed. It's a point-to-point link.


I never said it did. In fact, I specifically said that MAC addresses are associated with Ethernet, not point-to-point serial HDLC links. My question involved the address field of the HDLC header. HDLC uses an address field and I wanted to know what gets inserted in that field.


http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=WAN%2C%20Routing%20and%20Switching&topicID=.ee71a06&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cc2e4ce/0#selected_message


Quick question: Can you define what you mean when you say "point-to-point"? Is your definition topology based or address based?





Edison Ortiz Thu, 01/29/2009 - 13:02
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

HDLC uses an address field and I wanted to know what gets inserted in that field.


Did you have a moment to check my packet capture? It does show what gets inserted on that field..


Quick question: Can you define what you mean when you say "point-to-point"?


In the context of Frame-Relay? That's one kind of subinterface.


In the context of HDLC, it's based on Layer1/2 connectivity between to end-points.



__


Edison.

ex-engineer Thu, 01/29/2009 - 13:20
User Badges:

Edison:


I did get the answer to my original question several posts ago -- between the website you sent and Istvans trace.


How about in the context of Ethernet? If I have 2 routers connected to each other through a routed Ethernet interface, would you, according to your definition of point-to-point, consider that link -- that connection -- a point-to-point link?

Edison Ortiz Thu, 01/29/2009 - 13:28
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

How about in the context of Ethernet? If I have 2 routers connected to each other through a routed Ethernet interface, would you, according to your definition of point-to-point, consider that link -- that connection -- a point-to-point link?



Yes


No other device can connect on that segment, right?


ex-engineer Thu, 01/29/2009 - 14:00
User Badges:

OK, fair enough.


I'm asking you this because you were making the point/argument earlier that a data link layer/L2 address is not necessary for a point-to-point link, as if the insertion of an L2 address in an L2 header field depends on, from a topological perspective, whether the link is a point-to-point connection or not.


"On a Point-to-Point WAN segment, there is only ONE device at the remote send. Why the packet overhead?"


In truth, though, it's the technological requirements of the encapsulation protocol that necessitates the placement of that L2/data link layer address, not the manner in which the neighboring interfaces are connected.


Here is the output of a router whose ethernet interface is connected to another router's ethernet interface. It is, by your definition, a point-to-point connection. Nonetheless, it is an ETHERNET connection, and therefore the MAC address of the next hop's ethernet interface will be placed in the address field of the ethernet frame as it exits one router and heads to the other.


fhvrs001#sh cdp nei gi1/2 det

-------------------------

Device ID: fhvrs002

Entry address(es):

IP address: 19.210.146.234

Platform: cisco WS-C6503-E, Capabilities: Router Switch IGMP

Interface: GigabitEthernet1/2, Port ID (outgoing port): GigabitEthernet1/2

Holdtime : 130 sec


Version :

Cisco Internetwork Operating System Software

IOS (tm) s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(18)SXF5, RELEASE SOFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2006 by cisco Systems, Inc.

Compiled Sat 08-Jul-06 02:32 by kellythw


advertisement version: 2

VTP Management Domain: 'fhvrs02'

Duplex: full


fhvrs001#sh ip arp | in 19.210.146.234

Internet 19.210.146.234 122 0021.d8cc.f440 ARPA GigabitEthernet1/2

fhvrs001#


As the ARP table shows, an L2 to L3 address mapping exists for the next hop router and that MAC address will be placed in the address field of the L2 header, EVEN THOUGH it is a point-to-point link.


Richard Burts Thu, 01/29/2009 - 19:14
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Joe


To the point of your original question, I do not know of a layer 2 protocol that does not have some concept of address as part of its header. For some protocols like HDLC the address field is not very useful. But it is still there. For other layer 2 protocols the address is there and is useful.


I would like to comment in particular about some of the discussion of Frame Relay. In terms of the encapsulation of Frame Relay it does not matter whether it is a point to point subinterface or a multipoint interface, every Frame Relay frame going out has the DLCI field, which is its layer 2 addressing. And the DLCI is important to the Frame Relay switch to make its forwarding decision, whether it is part of a point to point connection or is part of a multipoint connection.


[edit] In looking back through this thread I notice this statement in one of your posts:

"I needed to know how the router resolves the IP address next-hop in its routing table with a L2 next hop for it to use in its L2 header"


I would say that for every entry in the routing table (and in the CEF tables which are used to make forwarding of packets more efficient) for every layer 3 next hop there is a corresponding layer 2 next hop. And that layer 2 next hop has some type of layer 2 address. In some, especially thinking of Ethernet, the layer 2 address is very obvious about what its useage is. For others, such as HDLC, it may be less obvious. But each layer 2 protocol has some concept of an address field related to the next hop.


HTH


Rick

ex-engineer Thu, 01/29/2009 - 19:53
User Badges:

Hi, Rick:


Thanks for your information.


I agree with everything you have stated.


"To the point of your original question, I do not know of a layer 2 protocol that does not have some concept of address as part of its header. For some protocols like HDLC the address field is not very useful. But it is still there. For other layer 2 protocols the address is there and is useful."


Agree and that was exactly the point I was making.


"I would like to comment in particular about some of the discussion of Frame Relay. In terms of the encapsulation of Frame Relay it does not matter whether it is a point to point subinterface or a multipoint interface, every Frame Relay frame going out has the DLCI field, which is its layer 2 addressing. And the DLCI is important to the Frame Relay switch to make its forwarding decision, whether it is part of a point to point connection or is part of a multipoint connection."


Well stated and I agree. I focused on point-to-point FR because I wanted to address Edison's comments regarding such connections.





Hi ex-engineer,

 

 

Few days ago, the router found its WAN2 . pub on an unknown.Mac ,  none of router mine.

 

Does this say :

A point to point  device has captured my Router ? Since nothing done NAT or p-p configured at my end.

The router-net speed down to 1/3 ISP plan with router whenever but , near 94% on modern most time though.

 

How to take over this ? Firmware updated twice covered the beta version .

 

 

Li

 

 

Actions

This Discussion