Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Lets say I have two hosts, 1 and 2, both connected to the same wireless router, same network and same subnet.

If 1 pings 2 will:

(a) 1 addresses a wireless packet to the router's MAC address, but addressed to 2's IP. The router, after receiving a packet, re-transmits the same packet to 2 (obviously the source MAC changed.)

(b) 1 simply transmits a packet directly to the MAC address of 2. or

(c) Something else happens.

share|improve this question

migrated from Feb 10 '11 at 1:29

This question came from our site for professional and enthusiast programmers.

"Broadcast" has a special meaning in networking, implying multiple receivers. "Send" might be clearer, in this context. – Jim Lewis Feb 10 '11 at 0:18

With all due respect, Paula Bean's answer is wrong.

client 1 does know whether or not client 2 is on the same subnet (layer 3). It doesn't know or care whether it's on a wireless or wired network (layers 1 and 2). It only knows and cares whether it's on the same subnet. Data meant for hosts on the same subnet is sent directly to those hosts, whether they're on a wired or wireless connection, no routing takes place, so the router does not replace the sender's MAC address with it's own MAC address and forward the data from client 1 to client 2. In fact, the routing function of the wireless router is not called in to play at all in this scenario as the data doesn't need to be routed because it's local to the same subnet. The wireless network is merely the physical medium on which the data is sent/recieved but it works like any other network at layers 1, 2, and 3. Data meant for hosts not on the same subnet operate as in scenario A, data meant for hosts on the same subnet operate as in scenario B.


Here's the layer 2 information for a network capture of a wireless client (Client 2) pinging a wired client (Client 1) on my home network. You'll see that the MAC address of the packet from the wireless client (SourceAddress) is the MAC address of the wireless NIC, not the MAC address of the wireless router.

Client 1:

Ethernet adapter Local Area Connection:

Physical Address. . . . . . . . . : 00-21-9B-06-71-B5

Client 2:

Wireless LAN adapter Wireless Network Connection:

Physical Address. . . . . . . . . : 00-22-5F-B0-5E-66

Network Capture:

Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-21-9B-06-71-B5],SourceAddress:[00-22-5F-B0-5E-66]

So as you see, because both clients are local to the same subnet, no routing takes place and the packets from the wireless client are sent directly to the wired client and the wireless router performs no routing and no MAC address replacement, and acts soley as the physical medium for intra-subnet communication.


When dealing with intra-subnet traffic the wireless router acts as a layer 2 device (switch). When dealing with inter-subnet traffic the wireless router acts as a layers 3 device (router).

share|improve this answer

I believe it is A. If you think about it, in a fairly common instance such as a wireless router with standard ethernet ports, the wireless client wouldn't have the ability to know weather or not the IP is on the wired network or if it is on the wireless. Only the router is privy to that information. Further, I imagine that the B scenario would introduce complications with encrypted communications.

share|improve this answer
Good points. Follow-up question: It is possible to perform a man in the middle attack between two hosts on the same subnet via ARP poisoning. Only the two clients are poisoned, and not the router. If all traffic passes through the router, wouldn't the router foil the attack? – byu146 Feb 10 '11 at 0:39
In an ARP Spoofing scenario - the man in the middle would try to associate their MAC address with the IP address of the gateway (router in this case). The Man in the middle could then choose to pass the data onward to the true gateway - so yes, I believe that it is still possible. – Paula Bean Feb 10 '11 at 0:54
Thanks for the answer Paula, but I meant a MITM between two clients both BEHIND the gateway. I did find the answer to my question though, Wireless 802.11 adds another level of addressing, the STA (station) level. Arp poisoning happens one level above this, so it all works out. – byu146 Feb 10 '11 at 0:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.