MAC Addresses Change at Every Hop, IP Addresses Do Not

Reading a capture on two links and seeing different MAC addresses for one packet is expected.

As a packet crosses a network, its MAC addresses are replaced at every router and its IP addresses stay the same from end to end. Engineers comparing packet captures from two places often take the changed MAC addresses as a sign of a fault, when it is exactly what routing does.

The symptom. You capture traffic on a laptop and on the server it talks to, two routers apart, and match up one packet by its contents. The IP source and destination agree in both captures. The MAC addresses agree in neither: the laptop's capture shows its own MAC as the source, and the server's capture shows a MAC address nobody recognises.

The addresses on one packet, as people expect them and as captures show them

Expectedone set of addresses for the whole trip

Source MAC: the laptop. Destination MAC: the server. Source IP: the laptop. Destination IP: the server. The same four values on every link.

CapturedMAC addresses rewritten per link

On the first link the frame goes from the laptop's MAC to the first router's MAC. On the last link it goes from the second router's MAC to the server's MAC. The two IP addresses are the same on both.

Why it happens. A frame only crosses one link. Each router receives the frame, removes it, reads the IP header inside to choose the next hop, and writes a brand new frame: its own outgoing card's MAC as the source, and the next device's MAC, found with ARP, as the destination. The packet inside goes on unchanged, apart from the time to live, which drops by one at each router.

What it costs. Time, mostly. An engineer who expects the server's capture to show the laptop's MAC concludes that the packet was tampered with, or filters the capture by the laptop's MAC and finds nothing. The real question goes unasked.

What to do instead. Match packets across captures by their IP addresses, ports and sequence numbers, never by MAC address, and expect the MAC pair to describe only the link the capture was taken on. One exception does change an IP address: a router doing NAT, as most home routers do, rewrites the source address as packets leave, and that is covered with IP addressing.

← → move through sections and cards