mjhjmtu

I recently began learning about the OSI model, networking and stuff.

As I like coding in C, I wanted to send my own Ethernet frames.

I now got it working; however, I'm still unsure about one thing:

When sending an Ethernet Frame from machine A to machine B (assuming that both machines are in the same network), what MAC address do I have to specify as Destination MAC address of the frame?

I tried both my router's MAC address and the MAC address of machine B, both ways do work. To get the MAC address of machine B, I simply made an ARP-request.

However, what's the right way?

I monitored the traffic with Wireshark on machine A and with tcpdump on machine B. That's the output on machine B (e0:d5:5e:c6:52:9a is the MAC address of machine B):

When specifying machine B's MAC address as destination address (a0:ce:c8:10:75:8c is the NIC MAC of machine A):

18:42:46.152800 a0:ce:c8:10:75:8c > e0:d5:5e:c6:52:9a, ethertype IPv4 (0x0800), length 64: 192.168.178.21.23455 > 192.168.178.27.23456: UDP, length 5

When specifying the router's MAC address as destination address (c8:0e:14:fd:f3:23 is the NIC MAC of the router):

18:45:04.735375 c8:0e:14:fd:f3:23 > e0:d5:5e:c6:52:9a, ethertype IPv4 (0x0800), length 60: 192.168.178.21.23455 > 192.168.178.27.23456: UDP, length 5

This result shows that the router rewrites the Source MAC address and probably uses his Cache to determine the correct destination MAC address for the destination IP.

How does the router handle the frame where the MAC address of machine B is specified?

Is there a difference between both ways?

Is there one preferred/correct way?

The generally correct method, if you know that the destination machine is on the local subnet, is to directly use the destination machine's MAC address (making an ARP lookup if necessary). This will work regardless of the frame's ethertype or contents, and will generally bypass the router (it will be short-circuited through the Ethernet switch).

If the frame contains IPv4 or IPv6, you may send it to the subnet's router, which will do an ARP lookup and forward the frame's payload to whatever host the destination IP address belongs to. (After all, that's what routers do: they forward IP packets – even if it just means reflecting them back to the same interface.)

However, sending local packets through a router is inefficient and completely unnecessary in most cases. For cheaper routers, it might mean having the packet processed by a very slow CPU (compared to full line speed of the Ethernet switch).

That said, the second method is occassionally used in practice, together with "client isolation" (aka "private VLAN") features on switches and access points.

Remember that Ethernet doesn't have routers. Routers are a layer 3 (network layer, where e.g. IP lives) concept, which is a layer above Ethernet, that Ethernet itself is supposed to have no knowledge of.

The correct address to put in the destination field of the Ethernet header is the Ethernet MAC address of the destination host.

In your question, you also mention sending an Ethernet frame to a host, and as it turns out that Ethernet frame contained an IP datagram for a different IP host than the Ethernet destination you sent it to. So that IP host happened to be acting as a router, and it routed your IP datagram for you by sending it back onto the same Ethernet LAN, but this time with the correct Ethernet destination address corresponding to the IP host address the IP datagram was address to.