Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading a book that stated that the MAC address (physical address) would change every hop but the IP address (logical address) would remain same in the image. Please help me understand it. Thanks

enter image description here

share|improve this question

closed as not a real question by Michael Hampton, Dan, Magellan, Ward, rnxrx Oct 15 '12 at 18:01

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Homework questions are off-topic for ServerFault. – Magellan Oct 14 '12 at 21:44

Keep in mind, mac addresses are only locally significant.

When the originating station (station A) goes to transmit a packet (to station z lets say), it looks at the Z's ip address A's own ip address and A's netmask. Once it has determined Z is not on a local subnet, it looks in its routing table to see if it can get to the network that Z is on. Most servers will have a default route for this, but could have multiple routes, either configured statically or learned dynamically.

Once A finds Z's subnet in it's routing table it does an arp of the ip address of the gateway(g1) that can get to Z. A now has the mac address of the g1. It put the frame on the network, with A's source IP, z's destination IP, A's source mac address, but the g1's destination mac address. This is how it gets to the gateway. (The IP addresses are never touched)

So, now the frame has made it to the g1. The gateway repeats the process, seeing if Z's subnet is locally connected or not. If it is, it arp's for Z's mac address. Once it has that, it sends the frame with A's Source IP, Z's Destination IP, the gateway's egress interface source mac address, but this time Z's destination mac address.

It Z is not local, and there is another router, then the gateway will arp the ip of g2, and get it's mac address. It will then send the frame again, this time with A's source IP, Z's destination IP, g1's egress interfaces's source mac, and g2's ingress interfaces's destination mac address. This keeps happening till the packet makes it to it's destination.

Basically, the source mac address keeps changing, but comes from the last device that transmitted the frame, and the destination mac address keeps changing, but is the next device that the frame is getting sent to, until it is eventually the actual station Z.

Also, that's only in an all ethernet world. Packets can also travel over different physical mediums, like T1's or sonet, which work differently than ethernet, and wouldn't have mac addresses at all. (potentially something equivalent for that medium though)

share|improve this answer

To enhance managability and interoperability, network protocols are organized in layers (you probably heard the term "network stack" or "network protocol stack"). The reference model for this layered approach is the OSI model:

  1. physical layer (cabling, adapters, ...)
  2. data link layer (Ethernet)
  3. network layer (IP)
  4. transport layer (TCP, UDP)
  5. session layer
  6. presentation layer
  7. application layer

For each layer there is a protocol that defines the communication between local and remote component on the same layer, and each component defines/implements interfaces only to its neighboring components (above and below).

Communication in an Ethernet (layer 2) uses MAC addresses for identifying source and destination of an Ethernet frame. Every interface attached to the ether receives all frames, but only processes those sent to its own MAC address (CSMA/CD). Ethernet-level communication cannot go beyond the broadcast domain, because MAC addresses can only be resolved within that network section.

When you want to address a host outside your Ethernet, you cannot resolve its MAC address, so you go up one level in the protocol stack (layer 3) and use a different addressing mechanism (IP). The Internet Protocol checks if the destination is within its own subnet and -if it isn't- sends it to a router. If the destination network (e.g. is not present in the host's routing table that's the default gateway, otherwise the router identified by the gateway address of the respective route.

What happens now is that the sending host creates in IP packet with its own address (e.g. in the source and the target address ( in the destination field and passes that down to the Ethernet layer. There the packet is encapsulated in Ethernet frames with the sending interface's own MAC address in the source field the router's MAC address in the destination field.

On the router's Ethernet interface the frames are re-assembled into an IP packet and passed up to the IP layer. The router sees from the destination IP address that the packet isn't sent to the router itself, so it passes the packet on according to its own routing table. Then the packet is passed to the interface associated with the address of the next router and re-encapsulated in an Ethernet frame, but this time with the first router's MAC address in the source field and the second router's MAC address in the destination field.

This process repeats for every Ethernet segment the packet crosses on its way to the destination.

share|improve this answer

When an IP packet arrives at a router for forwarding, it is encapsulated in an data link layer frame - typically an Ethernet frame. As far as Ethernet is concerned, the router's interface is the final destination for the frame, the router receives and "consumes" the frame.

After the routing decision is done and the IP packet data is ready to be sent out, the router re-encapsulates it into a new Ethernet frame. This new frame obviously would have different source and destination MAC addresses than before.

You can imagine the whole process as an IP envelope handed on from router to router in a larger Ethernet envelope. The Ethernet envelope gets torn open by every router, the router reads the destination address on the IP envelope to make the routing decision (i.e. determine the next router to relay the envelope to) and re-packages the IP envelope into a new Ethernet envelope before passing it on:

envelope visualisation

(linked from

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.