Does a typical router modify the L2 header (MAC address)?

I have a question relating to switching and routing. I'm going to simplify the actual IP addresses to make it simple to follow. Also, please consider the scope of my question around the typical router doing L3, and a typical switch doing L2 (e.g., no special device such as an L3 switch). Take the following scenario: Host A in network 1.x needs to communicate to Host B on network 2.x. In between Host A and Host B is a switch on the 1.x network (call it Switch A) that Host A connects to, a Router, and another switch on the 2.x network that Host B connects to. The router is configured to route between the 1.x and 2.x networks through two different interfaces (as would be expected on a router!); Switch A and Switch B are connected to their respective interfaces on this router. One of my colleagues contends the following: The router maintains a "master" ARP table and knows about all MAC addresses connected to it through every interface, even if those hosts are connected through X number of downstream switches. (point of contention #1). Additionally, my colleague contends the router will change the destination MAC address in the L2 header (frame) to the MAC address of Host B, will forward the packet to Switch B, and Switch B essentially does nothing but forward onto the target MAC already indicated in the packet (actually frame at that point). I contend the following: The router deals with Layer 3 only, and only cares about what interfaces connect to which networks. Hence, it knows nothing about MAC addresses of destination hosts connected to it (beyond *maybe* the MAC addresses of direct attached devices, typically switches - even that I'm not convinced, though). The router maintains a routing table only, and simply reads the destination IP in the L3 header, determines which interface is configured for that network, and sends it out that interface. It is the job of Switch B to determine the MAC address of the destination host via a lookup in it's own ARP table, and the switch will subsequently modify the L2 header with the destination host MAC address and send the request to that MAC (Host B). If a router was to truly know about all destination MAC addresses, it would simply get overloaded; the ARP table would be huge. It solely relies on a routing table, and that's it; the router lets the switch massage the L2 headers and deal with the IP<-->MAC address mapping via each switch's own independent ARP table. To summarize my questions: 1. Does a router maintain any ARP tables whatsoever? 2. Does a router know anything about MAC addresses, even directly connected devices, such as directly connected switches? 3. Does a router ever manipulate the L2 header? Or is this a job left solely for the switch? Now for the bonus questions: 4. How does this change on a L3 switch? 5. If L3 switches can do both routing + switching, why are routers and switches separate? If there's a "one device can do both", why are networks still employing separate devices, one for routing, and one for switching? Is it solely for bandwidth purposes, such as the ASIC technology is tuned for higher performance with the single-purpose devices? Or are there other reasons? I'd love to hear from anyone that can help refute/confirm my colleagues stance. Thank you, -Josh

Answer Wiki

Thanks. We'll let you know when a new response is added.

I should say your colleague is right.

Routers: Make routing decision according on routing table, which is based on L3 addresses, but do change L2 MAC headers. A router has the ARP entries of all hosts connected to all of its interfaces which have communicated through the router, but not the ARP entries of all hosts in the network. (Consider a multi-router set up, which is typical)

Switches: Make switching decision based on MAC table (not ARP table, it is different) but do not change the L2 MAC headers. Switches may add tags (IEEE 802.1q, Cisco ISL, etc.) to the MAC headers but the tags should have been removed before reaching the end hosts.

The typical operation is like this:

(1) The 1.x host (A) wants to send to 2.x host (B).
(2) A realises B is on a different network judging from the subnet mask and ip addresses and knows it need help from a router.
(3) A does an ARP operation to find out the MAC address of its default gateway, which is a router (R).
(4) A sends to R with source MAC = A’s MAC and destination MAC = R’s MAC. The switches in between them pass the frames intact.
(5) R sends to B, rewriting the source MAC to R’s MAC and the destination MAC to B’s MAC (before this it should have an ARP entry of B; otherwise it would do an ARP operation to find out B’s MAC).

CT Yau
Hong Kong

Discuss This Question: 9  Replies

There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.
  • Whanzens
    1. The router knows the mac addres of the directly attached devices (same ip-range), as it needs this in case of a hub or such device and local packets are send to mac address (I believe). 2. the router only knows the mac addresses of devices he has communicated with within a certain timespan, a switch knows all mac addresses connected to all ports. The router and switch don't know mac-addresses beyond a second router in a netwerk, because this is all done on ip-address. 3. I'm not so familiar with the L2 and L3 layers, but the router at least changes the hop-count in the packet. 4. Don't know. 5. A router is not always directly connected between two ethernet networks, but can also, depending on the type communicate over ADSL, ISDN, PSTN or FDDI, Tokenring, Atm or all kinds of other protocols.
    0 pointsBadges:
  • Tbitner
    1. Yes a router maintains an ARP table...just do a "show arp" to see all the IP->MAC addresses it knows. A router doesn't keep a "master" table per se, but keeps it's own local arp cache for traffic that it needs to frame for a local LAN. Every device has an arp cache including Windows that it consults before framing a packet as it passes down through the stack. 2. Yes a router has to know MAC addresses. On the local LAN, hosts communicate ONLY via hardware address. the router needs to frame the packet to send it to the next hop or local LAN. 3. A router has to append a L2 header for the packet to traverse the local LAN or proceed to next hop router. A switch does not add L2 headers to a packet. That is done either at the router or Windows TCP/IP stack. The switch only sends frames to the correct port based on L2 header. 4. On an L3 switch the switch examines past the L2 frame (mac address) to L3 header (packet). It then looks up the IP address and makes routing decisions (using ASIC). It effectively takes away local LAN routing decisions from the router (except for WAN routing). 5. You need a router for your WAN connection and for the default route. Plus L3 switches are more expensive. L3 switches are made for ASIC-based routing between VLANs, not for routing out to the Internet.
    510 pointsBadges:
  • MennoT
    The statement, that a router 'changes' the MAC address gives a wrong impression of the process. The router picks the L3 content, makes its routing decision and prepares a packet (frame) for the outgoing interface. Depending on the connected media, other L2 protocols than Ethernet could be used that do not use Ethernet MAC addresses at all. Also, fragmenting or reassembly may be involved and in that case too, the view as if an Ethernet frame came out of the router with a changed MAC address cannot be maintainded.
    0 pointsBadges:
  • vdog
    To answer your question about why not use just one device does all is pretty simple.. L3 (marketing term btw) or inter vlan routing capable switches are not meant to be used for functions like QoS, security, routing protocols etc... not to mention the different types of connections that are available as proprietary hardware modules.. a router is much more modular and flexible than a switch.. some L3 switches don't have anything more than standard rj45 connectors and sfp's... so other than copper or fiber.. you would be limited.. again in SOME switches.. there are obviously blade servers which can support more connection types.. but that's probably the main reasons.
    10 pointsBadges:
  • asadi80
    What if we configure VLANIF (L3 VLAN interface) on the switch port which is connected to the Router? Does switch change the host A source MAC address with its own interface MAC in this case?
    10 pointsBadges:
  • RashedKoutayni
    I think you can get out of your confusion by redefining some technical terms.
    It's not precise to understand the term: "the Router is L3 device" as a Layer 3 only device ... I would rather say: "the Router is L<=3 device" (i.e. less or equal).
    which means that the router is a device that deals with Layer 3 and below..
    although it doesn't have the whole switching functionality, it does have access to Layer 2.
    0 pointsBadges:
  • Raquib
    Hi guys I was looking for the same information like this, Only get authentic answer about the query from this discussion,I have found my router Ip from, but can anybody tell me how I can know my LAN Ip is?
    10 pointsBadges:
  • Subhendu Sen

    @Raquib, what did it mean by lan ip? Did you mean your system's IP or local IP? If yes, you can right click on Network icon on Taskbar & then click Open network and Sharing center to know this IP. However, that depends on OS type.

    140,380 pointsBadges:
  • TheRealRaven
    @Raquib : Please clarify what you mean by "LAN ip". Do you mean the IP address of your nearest router? Do you mean the "network address" for your local system? Do you mean the Internet address of your network's Internet presence? Something else?
    35,630 pointsBadges:

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

Thanks! We'll email you when relevant content is added and updated.


Share this item with your network: