9.1.3 Packet Tracer - Identify MAC and IP Addresses (Answers)

Yes. Three types of media are used: copper straight-through cables (connecting PCs to switches and the Router to Switch1), a copper crossover cable (between Switch1 and the Hub, because both are intermediary devices), and wireless 802.11 connections between the Access Point and the Laptops.

No. The type of cable (straight-through, crossover, or wireless) only affects the physical transmission of electrical signals at Layer 1. The content of the PDU — including all MAC addresses, IP addresses, and payload data — remains completely unchanged regardless of the media type used.

No. A Hub is a Layer 1 device that simply regenerates and repeats the electrical signal out all of its ports (except the port on which the signal was received). It does not inspect, modify, or discard any part of the frame. The complete PDU passes through intact.

Nothing. The Hub operates exclusively at Layer 1 (Physical layer). It has no awareness of MAC addresses (Layer 2) or IP addresses (Layer 3). It only sees raw electrical signals (bits) and floods them out every port. It does not maintain a MAC address table and cannot make any forwarding decisions.

Yes. It repackaged it as wireless 802.11. The Access Point re-encapsulates the incoming Ethernet (802.3) frame into an 802.11 wireless frame (and vice versa). This process changes the Layer 2 frame header — since 802.11 uses up to four MAC address fields compared to Ethernet's two — but the payload inside (the IP packet and its data) is preserved without any modification.

No. All addressing information is preserved during the conversion between 802.3 and 802.11 frame formats. The frame structure changes to accommodate the wireless medium, but the source and destination MAC addresses, as well as the IP addresses within the encapsulated packet, remain intact throughout the wireless transfer.

The Hub operates at Layer 1 (Physical) — it only regenerates and floods electrical signals without any understanding of frames or addresses. The Access Point operates at Layer 2 (Data Link) because it must read and re-encapsulate frame headers when converting between Ethernet 802.3 and wireless 802.11 formats, which is fundamentally a Layer 2 function.

Yes. Because the Hub floods every frame out all of its ports, devices that are not the intended destination will receive the frame, examine its Destination MAC address, find that it does not match their own MAC, and drop the frame — shown in Packet Tracer as a red "X". Similarly, the Access Point broadcasts wirelessly, so laptops that are not the intended recipient will also receive and reject the frame. This is normal behavior for Layer 1 devices that lack intelligent forwarding.

Destination. This reflects the actual structure of an Ethernet (IEEE 802.3) frame, where the Destination MAC field precedes the Source MAC field in the frame header.

Placing the Destination MAC first allows a switch to begin its forwarding decision as soon as possible. In cut-through switching mode, the switch can look up the destination MAC in its MAC address table and start forwarding the frame to the correct port immediately — without waiting for the entire frame to arrive. This design reduces forwarding latency significantly.

No. MAC addresses are assigned by hardware manufacturers and consist of a vendor-specific OUI (Organizationally Unique Identifier) prefix followed by a device-specific identifier. They have no logical relationship to IP addresses, network topology, or device location. In Packet Tracer, these are randomly assigned values that do not follow a meaningful pattern.

No. Unlike a Hub, a switch operates at Layer 2 and maintains a MAC address table (also called a CAM table). When a switch knows the destination MAC address, it forwards the frame only to the specific port associated with that address — not to all ports. This intelligent forwarding means that non-destination devices do not receive the frame, so no red "X" rejections occur at the switch level.

At the Router. When a packet crosses from one IP network to another, the Router performs Layer 3 processing: it de-encapsulates the incoming frame (strips the old Layer 2 header), reads the destination IP address, consults its routing table to determine the outbound interface and next-hop, and then re-encapsulates the packet into a new frame with new Source and Destination MAC addresses appropriate for the next network segment. The IP addresses (Source and Destination) remain unchanged throughout this process — only the MAC addresses change at each router hop.

Multiple devices share this prefix. The Router uses 00D0:BA8E:741A on its 172.16.31.0/24 interface and 00D0:588C:2401 on its 10.10.10.0/24 interface. PC 172.16.31.5 also has MAC address 00D0:D311:C788. This shared OUI prefix means these devices have network interface cards from the same manufacturer (or in Packet Tracer, were assigned addresses from the same simulated vendor range).

The other MAC addresses (those not starting with 00D0) belong to the end devices — the PCs and Laptops that act as the original senders and final receivers in each communication. For example, 000C:85CC:1DA7 belongs to PC 172.16.31.2 and 0060:2F84:4AB6 belongs to Laptop 10.10.10.2. In any given PDU exchange, the non-router MAC addresses always identify the source or destination host on the local network segment.

No. In an ICMP Echo Request (the outgoing ping), the Source IP always remains the address of the originating device and the Destination IP always remains the address of the target device — across every hop through switches, hubs, the access point, and the router. IP addresses are Layer 3 information and are not modified by intermediate devices during normal routing (NAT is not used in this lab).

Yes. In the ICMP Echo Reply (the "pong"), the original destination device becomes the new source, and the original source device becomes the new destination. For example, if PC 172.16.31.5 pings 10.10.10.2, the request carries Source IP 172.16.31.5 and Destination IP 10.10.10.2. The reply reverses this: Source IP becomes 10.10.10.2 and Destination IP becomes 172.16.31.5. This is how the reply finds its way back to the originator.

Each interface (port) of the Router is connected to a different, non-overlapping IP network. In this simulation, the wired side uses the 172.16.31.0/24 network and the wireless side uses the 10.10.10.0/24 network. All devices on the same physical segment share the same network prefix, and no two segments use the same address range. This is a fundamental requirement for IP routing to function correctly.

The core function of a router is to interconnect different IP networks and forward packets between them. Each router interface must belong to a unique subnet so the router can correctly determine which interface to use when forwarding a packet toward its destination. If two interfaces shared the same subnet, the router would be unable to distinguish which interface leads to the intended destination, causing routing ambiguity and communication failures.

The IPv4 addresses would be replaced with IPv6 addresses, but the fundamental networking behavior would remain the same. The key differences at a technical level would include: ICMPv6 would be used instead of ICMPv4 for ping operations, NDP (Neighbor Discovery Protocol) would replace ARP for MAC-to-IP address resolution, and the IPv6 packet header would have a different structure (e.g., no header checksum, a flow label field, and a simplified fixed-length header). However, the roles of each device — switches forwarding based on MAC addresses, the router changing MAC addresses at each hop while preserving source and destination IPs, and hubs flooding all traffic — would all remain exactly the same.

Two types of media are used in this topology: copper straight-through cables (connecting the Router to switches, switches to the Access Point, and switches to PCs) and wireless 802.11 connections between the Access Point and the Laptops.

No. The type of cable only affects the physical transmission of signals at Layer 1. The content of the PDU — including all MAC addresses, IP addresses, and payload data — remains completely unchanged regardless of the media type used.

Yes. It repackaged them as wireless 802.11 frames. The Access Point re-encapsulates the incoming Ethernet (802.3) frame into an 802.11 wireless frame (and vice versa). This process changes the Layer 2 frame header — since 802.11 uses up to four MAC address fields compared to Ethernet's two — but the payload inside (the IP packet and its data) is preserved without any modification.

No. All addressing information is preserved during the conversion between 802.3 and 802.11 frame formats. The frame structure changes to accommodate the wireless medium, but the source and destination MAC addresses, as well as the IP addresses within the encapsulated packet, remain intact.

Layer 2 (Data Link). The Access Point must read and re-encapsulate frame headers when converting between Ethernet 802.3 and wireless 802.11 formats. This re-encapsulation — reading the incoming frame header and rebuilding it in a different format — is fundamentally a Layer 2 function.

Cables operate at Layer 1 (Physical) — they simply carry electrical or optical signals between devices without any processing. The Access Point operates at Layer 2 (Data Link) because it performs re-encapsulation between Ethernet 802.3 and wireless 802.11 frame formats, which requires reading and rebuilding Layer 2 headers.

Destination. This reflects the actual structure of an Ethernet (IEEE 802.3) frame, where the Destination MAC field precedes the Source MAC field in the frame header. This design allows switches to begin their forwarding decision as soon as the destination address arrives, enabling cut-through switching which reduces latency.

The PDUs marked with red Xs were not accepted by a device because the destination address did not match the device's MAC address. The green check marks indicate that the destination MAC address matched and the PDU was accepted. This behavior is most visible with the Access Point, which broadcasts wirelessly to all connected devices. Laptops that are not the intended recipient will receive the frame, check the Destination MAC, find it does not match their own, and drop it — shown as a red "X". The intended recipient accepts the frame — shown as a green check mark.

At the Router. When a packet crosses from one IP network to another, the Router de-encapsulates the incoming frame (strips the old Layer 2 header), reads the destination IP address, consults its routing table, and then re-encapsulates the packet into a new frame with new Source and Destination MAC addresses appropriate for the next network segment. The IP addresses remain unchanged — only the MAC addresses change at each router hop.

The Router. The MAC address 00D0:BA8E:741A belongs to the Router's FastEthernet1/0 interface, which connects to the 172.16.31.0/24 network. The "00D0:BA" prefix is the OUI (Organizationally Unique Identifier) portion that identifies the manufacturer of the network interface card on that router port.

To the sending device and receiving device — the end devices (PCs and Laptops) that are the original senders and final receivers in each communication. For example, 0060.7036.2849 belongs to PC 172.16.31.3, 000C:85CC:1DA7 belongs to PC 172.16.31.2, and 0060:2F84:4AB6 belongs to Laptop 10.10.10.2. In any given PDU exchange, the non-router MAC addresses always identify the source or destination host on the local network segment.

No. In an ICMP Echo Request, the Source IP always remains the address of the originating device and the Destination IP always remains the address of the target device — across every hop through switches, the access point, and the router. IP addresses are Layer 3 information and are not modified by intermediate devices during normal routing (NAT is not used in this lab).

They switch because the receiving device is now the source. In the ICMP Echo Reply, the original destination device becomes the new Source IP, and the original source device becomes the new Destination IP. For example, if PC 172.16.31.3 pings 10.10.10.2, the request carries Src IP 172.16.31.3 → Dst IP 10.10.10.2. The reply reverses this: Src IP 10.10.10.2 → Dst IP 172.16.31.3. This is how the reply finds its way back to the originator.

The function of a router is to interconnect different IP networks. It must be a member of both networks to do this. Each router interface must belong to a unique subnet so the router can correctly determine which interface to use when forwarding a packet. If two interfaces shared the same subnet, the router would be unable to distinguish which interface leads to the intended destination, causing routing ambiguity and communication failures.

The 10.10.10.0/24 and 172.16.31.0/24 networks. The Router has two interfaces: one connected to the 10.10.10.0/24 network (wireless LAN side via Switch 1 and the Access Point) and one connected to the 172.16.31.0/24 network (wired LAN side via Switch 2). Each interface has an IP address within its respective subnet, allowing the router to forward packets between the two networks.