The ping traffic can now be transmitted with a source MAC address of A
which is the local machine, destination MAC addresses of C
in other words PC C the destination MAC address was learnt through ARP
Source IP address is 10.1.1.1
destination IP address is 10.1.1.2
When the hub receives the frame from PC A, it will repeat it
out of all interfaces except the interface it arrived on.
So the router will once again receive the frame but will drop it
because its MAC address is G
and the destination MAC address for this frame is C.
PC C will also receive the traffic and will accept it
because the destination MAC address is C and its local MAC address is C.
the layer 2 headers will be stripped and the IP address information
will be read by high layer protocols, this is an ICMP echo packet.
So the PC will reply with an echo reply message.
C will send the frame to the hub with the source MAC address of C
destination MAC address of A it knows the MAC address of A
because of the previous ARP request message.
So its ARP cache has a entry associating MAC address A
with IP address 10.1.1.1 so source Mac address in the frame is c
destination Mac address is A, source IP address is 10.1.1.2
destination IP address is 10.1.1.1
When the frame is receive by the hub
the hub will repeat it out of all ports
except the one on which was received.
The router will receive the frame but will drop it
because the destination MAC address is A not the G
the local routers MAC address.
When A receive the frame from the hub it will accept it
because the destination MAC address is A and the PC’s Mac address is A,
it will then strip layer 2 headers
and forward the information to higher layer protocols.
In this case it was an echo reply, so the ping will show a success message.
In other words an echo request was sent to PC C
and an echo reply message was successfully received back.
So in my Wireshark capture, for example, I can filter on ICMP messages
I can see the initial echo request message sent from my PC to 10.0.0.254
and I can then see the echo reply message.
Notice please that these are unicast frames.
Unicast firstly from my PC to the local router
and then a unicast from the router to my local machine.
The same information would be displayed if you were pinging
another local device on the segment.
As the user you would see something similar to this ping 10.0.0.254
and the ping was successful.
So in this example my PC successfully got a reply
from the remote device that I was pinging.