For both CCENT and CCNA level questions, you need to know a handful of key facts if you want to predict the values of MAC addresses, IP addresses, and TCP/UPP port numbers of a packet. Today I’ll summarize those points, for a packet that goes from PC1 to the server in Thursday’s question. Note that the question asked about packets going from the server to the client. If you’re a little unsure about your answer to the question, read over today’s blog, and re-think the question, to see if you change your mind or not.
First, a bit of terminology. In Cisco-speak, the terms frame, packet, and segment have specific meaning:
Frame: refers to the bits that flow in a network, specifically including the data link layer header/trailer, and all encapsulated data. EG, an Ethernet frame.
Packet: refers to the bits that flow in a network, specifically excluding the data link header/trailer, but including the network layer header, and any encapsulated data. EG, an IP packet.
Segment: refers to the bits that flow in a network, specifically excluding any data link and network layers headers/trailers, but including the transport layer header, and any encapsulated data. EG, a TCP segment.
With these three terms in mind, consider the following summary points that impact which numbers are used in frames, packets, and segments:
The Data Link layers job in an IP network is to deliver their encapsulated packets to the next router or host – so the data link layer header uses MAC addresses that represent the sending/forwarding host or router as the source, and the next (and not necessarily final) router or host as the destination. For example, when PC1 sends a packet to the server, the data link layers job is to send the IP packet, inside a frame, to a router – in this case, R1. So, PC1 sends a data link frame with PC1’s MAC as the source MAC, and R1’s upper LAN interface MAC address as the destination MAC address. As a result, the LAN switch delivers the frame to R1, which can then route the packet.
When routing packets, routers discard the data link header of incoming frames, leaving a packet, then adds a new data link header/trailer to the packet – with new data link addresses – before forwarding the frame. Following the same “PC1 sends a packet to the server” example, once R1 receives a frame from PC1, which holds an IP packet, R1 discards the incoming frame’s data link header and trailer, leaving the packet. R1 then builds a new data link header for the purpose of (in this case) sending the frame to R2. So, the new header has R1’s lower LAN interface’s MAC as the source, and R2’s upper LAN interface MAC as the destination – all so the switch in the middle of the network will deliver the frame to R2, in effect delivering the packet, which is inside the frame, to the next router.
For CCNA-level networks, a packet’s source and destination IP addresses should remain unchanged from the sending host to the destination host, unless NAT or VPNs are shown. For CCNA-level questions, you can assume NAT and VPN are not used unless stated or shown in the question. This question shows neither, so, for a packet sent by PC1 to the server, the source IP address should be PC1’s IP address, and the destination IP address be the server’s IP address, at all points in the path of the packet from PC1 to the server.
For CCNA-level networks, the client uses a port number >1023, and the server typically uses a well-known port number (80 for HTTP) – and the port numbers remain unchanged in a packet unless NAT or VPN is in use. For the same reasons as just stated, neither NAT nor VPN is used for this question. So, PC1’s port number is >1023, and the web server is assumed to use a well-known port, unless otherwise stated. It’s useful to memorize some of the more common well-known ports, like 20/21 for FTP, 23 for Telnet, 25 for SMTP, 53 for DNS, and 80 to HTTP. For example, for the packet/segment sent by PC1 to the server, the source port of the TCP segment, at all points from PC1 to the server, will be that port number that’s >1023. The destination port, at every point in the path from PC1 to the server, is port 80.
802.1Q trunking does not change the frame’s MAC addresses. 802.1Q inserts an additional 4-byte header into a frame, but it does not replace the MAC addresses. Cisco’s proprietary ISL, used mainly before the emergence of the IEEE-standard 802.1Q, encapsulated the original frame inside another frame, with the new frame header using other MAC addresses. However, 802.1Q does not change the MAC addresses in use.
I’ll get to the literal answer to the question next post. By the way, I’d be curious as to whether you think you’d have found the answer more quickly – and how much more quickly – if all the above information was in the forefront of your mind before you started to answer the question. Feel free to post some opinions. Thanks!
