Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have the weird problem that certain incoming packets get forwarded to my internal netwerk with the right internal IP but when using wireshark i see that the MAC address is set to the routers default gateway.

Setup: <<< Internet server>>> <<< CISCO >>> <<< Draytek / >>> <<< Internal device >>>

Def GW Draytek:
Def GW internal devices:

So packets come from the internet server, get to the draytek, then the draytek forwards them inward with ip BUT with the MAC from the Cisco (

Draytek routing table:

Key: C - connected, S - static, R - RIP, * - default, ~ - private
* via WAN1
C directly connected WAN1
C~ directly connected LAN
share|improve this question

That's normal.

I'm not sure if I should say anything else on this or not, but I can edit to elaborate if you need me to.

EDIT for elaboration: MAC addresses are not transmitted across layer 3 (routed) boundaries. They are only used to transmit frames within a single broadcast domain. MAC addresses are (generally) hard coded into a device which makes them useless for routing information on the Internet. Therefore, the MAC address information is stripped at the gateway.

Basically: When a packet is transmitted within a subnet, the MAC address is used by the network to route it. When you go outside your immediate subnet, then the IP is used.

share|improve this answer
Elaborate please and thanks for the fast reply. – marshallq Mar 23 '11 at 13:21
+1, For clarity, the MAC-From should (normally) always be from the host that's sending the packet, in this case the router. The MAC-To should always be the MAC of the host on the local network the packet is going to. IPs and MACs are not globally tied, they operate independently at different layers of the OSI model. – Chris S Mar 23 '11 at 13:28
Thanks allot for all the feedback but i don't think i've written down the problem in a good way because i don't think you get my problem. Host (aka internal device): with mac 11:00 Cisco: with mac 00:01 What happens is that a incoming packet from the internet on the draytek gets forwarded to my internal network with ip as destination ip and 00:01 as dest mac. While the dest mac should be 11:00. Ps. I think the draytek messed up somewhere. We did 7 days of logging for some hardware tests and it only happened during 1 day. But i like to learn from it :) – marshallq Mar 23 '11 at 18:04
Post the ARP table from the Draytek. – Hyppy Mar 23 '11 at 18:07
@Hyppy why do you need it? The problem only happened once in all of our tests (tested 7 days with turning off/on devices during the night). – marshallq Mar 24 '11 at 6:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.