How does a packet find its way from a LAN device to a router, or vice versus?

Question

I am trying to understand how packets are sent from one device to another in a wireless network? (Perhaps the same question also applies to a wired network) How does a router know in which physical direction to send a packet in order for a particular IP/MAC address to receive it? Or is this not the case, and is the data sent out or scattered in a random direction, and all devices on a network listen to all network traffic and act only on those matching its IP/MAC address? If the latter is true, does this not raise security vulnerabilities? And is the same is true of wired networks?

Answer 1

Hi,

It will be easier to tackle this from a Wired Network perspective first, before reviewing how it works with Wireless. Although they do work very similarly, the main difference will be the behavior of Hardware (MAC) Address forwarding between the Endpoint devices and the Switch vs. Endpoint devices and a Wireless Access Point/Controller. In order to understand how this concept works on Wired Networks, it's important to first understand the OSI and TCP/IP model, but more specifically know how the IEEE (Institute of Electrical and Electronics Engineers) 802.3 standard (which is "Ethernet") Switching works and also how IPv4 Routing and ARP works.

The best way to explain this is to give you a scenario of one PC trying to communicate with another PC that resides within a separate Network. We will look at how the traffic would get from one device to the other and the interactions between the Network devices between the two PCs.

Here's a basic Network Diagram of the scenario:

1. PC-A ==> Switch-A ==> RouterX <== Switch-B <== PC-B

Let's look at the following steps that will occur when PC-A tries to ping PC-B:

1. (PC-A has an IP Host Address of 192.168.1.2 and Subnet Mask of 255.255.255.0)
2. (PC-A has a MAC Address of "A" but in reality a MAC Address is a Hexadecimal string that's 48 Bytes long and typically in the format of: "00:01:01:AA:AA:AA" for example. But for the purpose of this exercise we will simply use "A")
3. (PC-B has an IP Host Address of 192.168.2.3 and Subnet Mask of 255.255.255.0)
4. (PC-A has a MAC Address of "B")
5. (Router-X has a MAC Address of "C")

1. After you enter the "ping 192.168.2.3" command on PC-A, PC-A will perform a Logical "AND" Operation on the Source IP (192.168.1.2) and Destination IP (192.168.2.3), comparing its IP Host Address and Subnet Mask against the IP Address of the Destination Host in order determine whether or not it is on the same network as the Host that it is pinging. The reason it does this is to determine whether or not it has to send the Ethernet Frame to the Router or if it can send it directly to the Destination Host. In IP Routing, if a Destination Host resides within a different network, then the packet must be routed by a Router (or any device that has a Route Processor and does Routing "Layer 3")
2. After PC-A makes an assessment; comparing the combination of its own IP Host Address and Subnet Mask and the IP Host Address of PC-B, it is able to determine that the two devices are on two separate networks (You can take my course if you would like to know why this is so and to learn more about IP Subnetting) and therefore when PC-A sends the Ethernet Frame containing the Ping "Echo Request", it will fill out the Destination MAC Address field in the Ethernet Frame to it's "Default Gateway's", (or in this case, RouterX's) MAC Address. It already knows the IP Address of it's Default Gateway (Router) because it already has it configured on it's NIC card. (A Ping Echo Request is encapsulated in an IP Packet and that IP Packet is then further encapsulated in the Ethernet Frame).
3. PC-A will now actually build the Ethernet Frame containing the Ping Echo Request and as it's filling out all of the required fields in the Ethernet Frame, it looks in its ARP Cache and realizes that it doesn't have the MAC Address for it's Default Gateway (RouterX - 192.168.1.1). This typically happens when the NIC Card on the PC has just initialized and the PC and Router still have not yet communicated. It knows the IP Host Address for RouterX (because it's already configured on the PC, but now it need's the MAC Address Associated with that IP.
4. This is where the protocol ARP (Address Resolution Protocol) comes into play. In order for PC-A to find the Associated MAC Address, it needs to send a Broadcast Message, containing an "ARP Request", which asks all hosts in the same network to please Reply if they have a Network Interface configured with the MAC Address listed in the ARP Request. In other words, the ARP Request asks: "Who has the MAC Address for the IP Address of 192.168.1.1)." So PC-A then suspends (pauses) the sending of the Ethernet Frame containing the Ping Echo Request and it generates a separate Ethernet Frame containing the ARP Request for RouterX's MAC Address.
5. PC-A will send that Ethernet Frame containing the ARP Request to Switch-A and this is where the Switch will perform a couple of it's basic functions:
6. Address Learn: It learns the MAC Address listed in the "Source MAC Address" field of the Ethernet Frame that it just received and associates it with the Switchport from which it received it on and stores that information in it's MAC Address Table.
7. Filter/Forward: It will look in the "Destination MAC Address" field of the Ethernet Frame and if it sees "12 F's" (FF:FF:FF:FF:FF:FF), this indicates that the Frame is a Broadcast Frame and therefore, the Frame needs to be "Flooded" (copied and sent out to) every port on the Switch except the port upon which the Frame came in on. Since an ARP Request is one type of a Broadcast Frame, that is what will happen in this instance.
8. Only Router-X will receive the ARP Request (Because Routers create a boundary for Broadcasts. Broadcasts are not forwarded beyond a Router Interface by default) and store the MAC Address within the "Source MAC Address" field (which is PC-A's MAC Address - "A") along with the Associated IP Host Address of PC-A (192.168.1.2) into its ARP Cache.
9. Router-X realizes that it has an Interface with that Destination IP Address (192.168.1.1) configured on it. So, according to the standards of ARP (Address Resolution Protocol), Router-X is now obligated to send an Ethernet Frame containing an ARP Reply.
10. Since Router-X had stored PC-A's MAC Address and IP Host Address into its ARP Cache from the ARP Request that PC-A sent out earlier. This ARP Reply will now be encapsulated in a Unicast Ethernet Frame, with PC-A's MAC Address ("A") filled out in the Destination MAC Address field and it's own MAC Address ("B") filled out in the Source MAC Address field of the Ethernet Frame and it will send that Frame to Switch-A.
11. Switch-A receives Router-X's Ethernet Frame containing the ARP Reply and performs it's basic functions again, but this time with a twist on the 2nd Function ("Filter/Forward"):
12. Address Learn: It learns the MAC Address in the "Source MAC Address" field of the Ethernet Frame that it just received (which is now Router-X's MAC Address this time) and associates it with the Switchport from which it received it on and stores that information in it's MAC Address Table
13. Filter/Forward: It will look in the "Destination MAC Address" field of the Ethernet Frame and see that there is now a single MAC Address (PC-A's MAC - "A") and therefore, it will look in it's MAC Address Table to see if it has an entry for it along with which Switchport that the MAC Address can be found. It will surely find an entry for that MAC Address/Switchport combination since PC-A had previously sent an Ethernet Frame containing an ARP Request to the Switch and it was stored in the MAC Table. Therefore, Switch-A will Forward the Ethernet Frame containing Router-X's ARP Reply out of the Switchport where PC-A can be found only.
14. PC-A will receive the Ethernet Frame containing Router-X's ARP Reply (which contains RouterX's MAC Address) and stores it in it's ARP Cache.
15. At this point, PC-A can now Un-suspend the Ping Echo Request since it has all of the information to fill out the Ethernet Frame and now fills the Destination MAC Address field with Router-X's MAC Address.

Now, you may be wondering at this point, "if PC-A is supposed to be pinging PC-B, why is it going through the trouble of trying to acquire information from Router-X? How will the Ping Echo Request even reach PC-B and how will PC-B know that the Ping is meant for it?"

This is where it's crucial to understand how Ethernet Switching, which operates at Layer 2 and IP Routing, which operates Layer 3 interact and the different Addressing Mechanisms used by both. Therefore, a thorough understanding of the OSI and/or TCP/IP model is required. PC-A and PC-B reside on two different Networks (Subnets) therefore, a Router (Router-X) is required to Route traffic between them. Since Router-X has an Interface in Both Networks or "LANs" (192.168.1.0/24 and 192.168.2.0/24), it can route traffic between both LANs.

**The key point is that in order for the PCs to send the packets to the Router, the ieee 802.3 Ethernet standard requires them to communicate at Layer 2 using Ethernet Frames which contain their "Hardware" or "MAC" Addresses, which are burned into their NIC Cards. But, inside of those Ethernet Frames (in the Payload field) lies the actual IP Packet that contains the Data that one Host is trying to send to another.

It works similarly with Wireless Networks however, the Address Learning and Forwarding is different with the 802.11 standards than it is with Ethernet. You will have to take my course to find out more ;-)