Routing Process Continued -- Behind the PING

ICND1 and ICND2 break down

In a previous post, we have examined host to host communication process, here we will examine routing process step by step. Understanding the routing process is critical to pass your CCENT and CCNA exam, and it is also the fundamental of networks, so let's make it crystal clear by looking at an example.

The modern Internet Ping command refers to a program was written by Mike Muuss in December, 1983. It sends a small packet of information containing an ICMP ECHO_REQUEST to a specified computer, which then sends an ECHO_REPLY packet in return. Let's exam what happens after a ping command is issued.

behind the ping

Refer to the exhibit. The LAN contains 2 hosts, 2 hubs and 2 routers. With subnetmask 255.255.255.240 or /27, router R4 and R5 divide the LAN into 3 subnets -- host A and R4's 192.168.10.33/27 interface belongs to 192.168.10.32 subnet; R4's 192.168.10.65/27 interface and R5's 192.168.10.66/27 interface belongs to 192.168.10.64 subnet; R5's 192.168.10.129/27 interface and host B belongs to 192.168.10.128 subnet.  Notice the layer 1 device hub have neither IP address nor ethernet address.

Now, host A pings host B, what happened exactly behind the magic "PING" command.

• Step 1, command "ping 192.168.10.134" is issued in the console at host A.


• ping program is envoked, which reads IP address 192.168.10.138 from user input, and hands it to Internet Control Message Protocol (ICMP).


• ICMP then creates an echo request payload.


• ICMP hands the payload to Internet Protocol (IP). IP then creates a packet with IP source address 192.168.10.34 and destination address 192.168.10.134. The Protocol field of the packet has value 0x01, which means ICMP.


• After the packet creation, IP determines whether the destination IP address is on the local network or a remote network. The subnet mask stored on Host A 255.255.255.240 is bitwise AND to host A's IP address 192.168.10.34 to determine that host A belongs to 192.168.10.32 subnet. With the same manner, IP determines that host B belongs to another subnet 192.168.10.128. 


• Since IP determines that this is a remote request, the packet needs to be sent to the default gateway so the packet can be routed to the remote network. The default gateway is stored in host A as 192.168.10.33 (either statically configured by the user or dynamically configured by DHCP).


• Because hosts only communicate via hardware addresses on the local LAN, for this packet to be sent to the default gateway, the hardware address of the default gateway (router's interface with IP address 192.168.10.33) must be known. 


• The ARP cache of the host is checked to see if the IP address of the default gateway has already been resolved to hardware address. If it has, the packet is then handed to the Data Link layer with the hardware destination address. Otherwise, an ARP broadcast (to IP address 192.168.10.63) is sent out onto the broadcast domain (subnet 192.168.10.32) to search for the hardware address of 192.168.10.33. The router responds to the request with hardware address of ethernet interface 192.168.10.33, and Host A caches this address.


• IP hands the packet down to Data Link layer for framing. The Data Link layer frames the packet of information and includes the following in the header: the destination hardware address 9999.DADC.1234, the source hardware address BBBB.3333.5677, the Ether-Type field with 0x0800 (IP) in it, and the FCS field with the CRC result.


• The frame is now handed down to the physical layer to be sent out over the network medium one bit at a time.


• The router R4's Ethernet interface with MAC address 9999.DADC.1234 receives the bits and builds a frame. The CRC is run, and FCS field is checked to make sure the answers match.


• Once the CRC is found to be okay, the hardware destination address is checked. Since the router's interface is a match, the packet is pulled from the frame and the Ether-Type field is checked to see what protocol at the Network layer the packet should be delivered to.


• The protocol is determined to be IP, so it gets the packet. IP runs a CRC check on the IP header first and then checks the destination IP address. The destination address is 192.168.10.134, which doesn't match any of the router R4's interfaces. Therefore, the routing table is checked to see whether it has a route to 192.168.10.134. If there's no entry found for 192.168.10.134, the packet will be discarded. If there's an entry found for 192.168.10.134, (For example, command "show ip route" reveals an entry such as "S    192.168.10.134/24 [1/0] via 192.168.10.66") the packet is ready to be sent out from interface 192.168.10.65, which directly connects to the next hop 192.168.10.66.


• The router checks the ARP cache to determine whether the hardware address for 192.168.10.66 has already been resolved. If it has, the packet is then handed to the Data Link layer with the hardware destination address. Otherwise, an ARP broadcast (to IP address 192.168.10.95) is sent out onto the broadcast domain (subnet 192.168.10.64) to search for the hardware address of 192.168.10.66. The router R5 responds to the request with hardware address of ethernet interface 192.168.10.66, and Router R4 caches this address.


• The hardware address and packet are handed to the Data Link layer. The Data Link layer builds a frame with the destination address (MAC address corresponding to 192.168.10.66, not shown in the exhibit) and source hardware address (MAC address corresponding to 192.168.10.65, not shown in the exhibit) and then puts IP in the Ether-Type field. A CRC is run on the frame and the result is placed in the FCS field.


• The frame is then handed to the Physical layer to be sent out onto the local network one bit at a time.


• The destination Router R5 receives the frame, runs a CRC, checks the destination hardware address, and looks in the Ether-Type field to find out whom to hand the packet to.


• The protocol is determined to be IP, so it gets the packet. IP runs a CRC check on the IP header first and then checks the destination IP address. The destination address is 192.168.10.134, which doesn't match any of the router R5's interfaces. Therefore, the routing table is checked to see whether it has a route to 192.168.10.134. If there's no entry found for 192.168.10.134, the packet will be discarded. But router R5 is directly connected with Host B, there should be an entry in the routing table like "C    192.168.10.134/24 is directly connected, FastEthernet0".  This means the packet is ready to be sent out from interface 192.168.10.129, which directly connects to the Host B 192.168.10.134. Notice hub don't have IP address, it is just a multi-port signal repeater.


• The router checks the ARP cache to determine whether the hardware address for 192.168.10.134 has already been resolved. If it has, the packet is then handed to the Data Link layer with the hardware destination address. Otherwise, an ARP broadcast is sent (to IP address 192.168.10.159) out onto the broadcast domain (subnet 192.168.10.128) to search for the hardware address of 192.168.10.134. The Host B responds to the request with hardware address DDDD.4444.1357, and Router R5 caches this address.


• The hardware address and packet are handed to the Data Link layer. The Data Link layer builds a frame with the destination address DDDD.4444.1357 and source hardware address 5555.AAAA.6666 and then puts IP in the Ether-Type field. A CRC is run on the frame and the result is placed in the FCS field.


• The frame is then handed to the Physical layer to be sent out onto the local network one bit at a time.


• The destination Host B receives the frame, runs a CRC, checks the destination hardware address, and looks in the Ether-Type field to find out whom to hand the packet to.


• IP is the designated receiver, and after the packet is handed to IP at the Network layer, it checks the protocol field for further direction. IP finds instructions to give the payload to ICMP, and ICMP determines the packet to be an ICMP echo request.


• ICMP creates an echo reply payload.


• ICMP hands the payload to Internet Protocol (IP). IP then creates a packet with IP source address 192.168.10.134 and destination address 192.168.10.34. The Protocol field of the packet has value 0x01, which means ICMP.


• After the packet creation, IP determines whether the destination IP address is on the local network or a remote network.


• Since IP determines that this is a remote request, the packet needs to be sent to the default gateway so the packet can be routed to the remote network. The default gateway is stored in host B as 192.168.10.129 (either statically configured by the user or dynamically configured by DHCP).


• The hardware address of 192.168.10.129 is found with ARP process, and the hardware address 5555.AAAA.6666 and packet are handed to the Data Link layer.


• The Data Link layer builds a frame with the destination hardware address 5555.AAAA.6666 and source hardware address DDDD.4444.1357 and then puts IP in the Ether-Type field. A CRC is run on the frame and the result is placed in the FCS field.


• The frame is then handed to the Physical layer to be sent out onto the local network one bit at a time.


• The destination router R5 receives the frame, runs a CRC, checks the destination hardware address, and looks in the Ether-Type field to find out whom to hand the packet to.


• IP is the designated receiver, and after the packet is handed to IP at the Network layer, IP runs a CRC check on the IP header first and then checks the destination IP address. The destination address is 192.168.10.34, which doesn't match any of the router R5's interfaces. Therefore, the routing table is checked to see whether it has a route to 192.168.10.34. If there's no entry found for 192.168.10.34, the packet will be discarded. If there's an entry found for 192.168.10.34, (For example, command "show ip route" reveals an entry such as "S    192.168.10.34/24 [1/0] via 192.168.10.65") the packet is ready to be sent out from interface 192.168.10.66, which directly connects to the next hop 192.168.10.65.


• The router checks the ARP cache to determine whether the hardware address for 192.168.10.65 has already been resolved. If it has, the packet is then handed to the Data Link layer with the hardware destination address. Otherwise, an ARP broadcast is sent out onto the network to search for the hardware address of 192.168.10.65. The router R4 responds to the request with hardware address of ethernet interface 192.168.10.65, and Router R5 caches this address.


• The hardware address and packet are handed to the Data Link layer. The Data Link layer builds a frame with the destination address (MAC address corresponding to 192.168.10.65, not shown in the exhibit) and source hardware address (MAC address corresponding to 192.168.10.66, not shown in the exhibit) and then puts IP in the Ether-Type field. A CRC is run on the frame and the result is placed in the FCS field.


• The frame is then handed to the Physical layer to be sent out onto the local network one bit at a time.


• The destination Router R4 receives the frame, runs a CRC, checks the destination hardware address, and looks in the Ether-Type field to find out whom to hand the packet to.


• The protocol is determined to be IP, so it gets the packet. IP runs a CRC check on the IP header first and then checks the destination IP address. The destination address is 192.168.10.34, which doesn't match any of the router R4's interfaces. Therefore, the routing table is checked to see whether it has a route to 192.168.10.34. If there's no entry found for 192.168.10.34, the packet will be discarded. But router R4 is directly connected with Host A, there should be an entry in the routing table like "C    192.168.10.34/24 is directly connected, FastEthernet0".  This means the packet is ready to be sent out from interface 192.168.10.33, which directly connects to the Host A 192.168.10.34. Notice hub don't have IP address, it is just a multi-port signal repeater.


• The router R4 get the hardware address for 192.168.10.34 with ARP process.


• The hardware address and packet are handed to the Data Link layer. The Data Link layer builds a frame with the destination address BBBB.3333.5677 and source hardware address 9999.DADC.1234 and then puts IP in the Ether-Type field. A CRC is run on the frame and the result is placed in the FCS field.


• The frame is then handed to the Physical layer to be sent out onto the local network one bit at a time.


• The destination Host A receives the frame, runs a CRC, checks the destination hardware address, and looks in the Ether-Type field to find out whom to hand the packet to.


• IP is the designated receiver, and after the packet is handed to IP at the Network layer, it checks the protocol field for further direction. IP finds instructions to give the payload to ICMP, and ICMP determines the packet to be an ICMP echo reply.


• ICMP acknowledges the ping program that it has received the reply, ping program then sends an exclamation point (!) to the user interface.


• ICMP then attempts to send four more echo requests to the destination host.

We have walked through the ping process step by step in the above demonstration. All these steps are hidden behind a single command "ping 192.168.10.134". As the packet traverses from router to router, layer 3 source and destination addresses do not change when the packet traverse, whereas layer 2 frame header and trailer are removed and replaced at every layer 3 device.