A router’s core job sounds simple: receive a packet on one interface, forward it out another. What actually happens in between — the router switching function — is where a genuinely important CCNA concept lives: IP addresses stay constant for the entire journey from source to destination, while MAC addresses get rewritten at every single hop. Understanding exactly why, and being able to trace it through a real topology, is worth getting comfortable with.
This guide covers the key terms, walks through a complete worked example with a full stage-by-stage address table, and explains why point-to-point serial links break the MAC-address pattern entirely.
Key Terms
- Encapsulation: wrapping a Layer 3 packet with a Layer 2 header and trailer to prepare it for transmission over a specific physical medium.
- De-encapsulation: removing the Layer 2 header and trailer to expose the Layer 3 packet for a routing decision.
- Layer 2 frame: a data-link-layer unit containing a header (commonly MAC addresses), a payload (the encapsulated IP packet), and a trailer (typically a CRC for error checking).
- Routing table: the database a router consults to determine the best outgoing interface for a given destination IP address.
- MAC address: a 48-bit address assigned to a network interface, used for delivery within a single Layer 2 segment.
The Router Switching Function, Step by Step
- The router receives a Layer 2 frame and de-encapsulates it, stripping the header and trailer to expose the Layer 3 packet.
- The router reads the packet’s destination IP address and looks it up in the routing table to determine the best outgoing interface.
- The router encapsulates the Layer 3 packet into a new Layer 2 frame — appropriate for the outgoing interface’s medium — and forwards it out that interface.
This cycle repeats at every router along the path. Each one only ever looks at the Layer 3 destination to make its forwarding decision; the Layer 2 framing gets completely rebuilt fresh at each hop. It’s worth emphasizing that the router never needs to inspect, remember, or care about the original source MAC address once it’s made its forwarding decision — Layer 2 information is strictly local to each individual segment, discarded and rebuilt fresh every time, which is precisely why it’s able to change so completely between the first hop and the last.
A Complete Worked Example
Consider a topology where Laptop1 (192.168.0.1, connected wirelessly) sends an ICMP echo request to Server0 (192.168.3.2), traveling through a wireless router and three intermediate routers, with a point-to-point serial link between two of them:
Laptop1 --(wireless)--> WirelessRouter0 --(Ethernet)--> Router1 --(Ethernet)--> Router2 --(serial)--> Router3 --(Ethernet)--> Server0At every Ethernet hop, the frame gets a new source and destination MAC address. At the serial hop, there’s no MAC address at all — more on why below. Throughout the entire journey, the source IP (192.168.0.1) and destination IP (192.168.3.2) never change.
| Stage | Segment | Source MAC | Destination MAC | Source IP | Destination IP |
|---|---|---|---|---|---|
| 1 | Laptop1 → WirelessRouter0 | Laptop1’s wireless NIC | WirelessRouter0’s wireless interface | 192.168.0.1 | 192.168.3.2 |
| 2 | WirelessRouter0 → Router1 | WirelessRouter0’s LAN interface | Router1’s interface | 192.168.0.1 | 192.168.3.2 |
| 3 | Router1 → Router2 | Router1’s interface | Router2’s interface | 192.168.0.1 | 192.168.3.2 |
| 4 | Router2 → Router3 | (none — serial link) | (none — serial link) | 192.168.0.1 | 192.168.3.2 |
| 5 | Router3 → Server0 | Router3’s Fa0/0 interface | Server0’s NIC | 192.168.0.1 | 192.168.3.2 |
The pattern is unmistakable once it’s laid out this way: five stages, five completely different MAC address pairs (four of them, since stage 4 has none), and exactly one IP address pair, unchanged from start to finish.
When Server0 replies, every stage reverses — source and destination IP addresses swap (now 192.168.3.2 to 192.168.0.1), and each hop’s MAC addresses are rebuilt fresh in the opposite direction, following the exact same de-encapsulate/route/re-encapsulate cycle in reverse order.
Why Serial Links Don’t Use MAC Addresses
MAC addresses exist to solve a specific problem: on a multi-access network like Ethernet, many devices share the same physical or logical segment, so a frame needs a destination address to tell every other device on that segment “this one isn’t for you.” A point-to-point serial link, like the one between Router2 and Router3 above, has exactly one possible recipient on the other end — there’s no ambiguity to resolve, so protocols like HDLC and PPP simply don’t include MAC addressing at all.
This distinction extends beyond just serial links, too. Any genuinely point-to-point connection — including certain WAN technologies and some tunnel interfaces — shares this same property, while anything resembling a shared segment with multiple potential recipients needs addressing to disambiguate. Recognizing which category a given link falls into is often the fastest way to predict whether you should expect to see MAC addresses in a capture of that specific link at all, well before actually taking the capture to check.
This is a genuinely useful detail to recognize when reading a packet capture or a Packet Tracer simulation: a Layer 2 header with no MAC addresses at all is a strong, immediate signal that you’re looking at a serial or other point-to-point link, not Ethernet.
Different Encapsulation for Different Media
It’s common — expected, even — for a router to receive a frame in one Layer 2 encapsulation type and re-transmit it in a completely different one. A frame arriving over a wireless connection uses Wi-Fi framing; the same packet leaving over an Ethernet interface uses Ethernet framing; the same packet again leaving over a serial interface uses HDLC or PPP framing. The wireless interface itself is a real physical radio interface on the device — not fundamentally different in kind from a wired Ethernet port, just using a different physical medium and corresponding Layer 2 framing.
Fast Ethernet, Gigabit Ethernet, and serial interfaces likewise each use their own specific encapsulation, which is exactly why the router switching function has to rebuild the Layer 2 frame from scratch at every hop rather than simply relaying the original one forward.
Verifying This in Practice
Trace the hop-by-hop path to see each router the packet actually passes through:
Router# traceroute 192.168.3.2Check the routing table entry a specific router will use to forward toward the destination:
Router# show ip route 192.168.3.2In Cisco Packet Tracer’s Simulation mode, clicking on a packet as it crosses each device shows the PDU details directly — the exact source/destination MAC and IP addresses at that specific point in the journey, which is the most direct way to confirm the pattern in this guide for yourself rather than taking it purely on faith. Stepping through a simulation one hop at a time, comparing what you see against the table above, is genuinely one of the more effective ways to internalize this concept before an exam.
Router Switching Function vs. Layer 2 Switching
It’s worth distinguishing this from Layer 2 switching, since both use the word “switching” but describe genuinely different processes. A Layer 2 switch forwards frames based purely on MAC address lookups within a single broadcast domain — it never touches IP addressing and never rebuilds the Layer 2 frame, since the frame is only ever traveling within one segment. The router switching function described in this guide is a Layer 3 process: it makes forwarding decisions based on IP addressing and rebuilds the Layer 2 frame completely at every hop, precisely because the packet is crossing between different segments.
| Factor | Layer 2 Switching | Router Switching Function |
|---|---|---|
| Forwarding decision based on | MAC address table | Routing table (IP destination) |
| Frame rebuilt | No — same frame, forwarded as-is | Yes — new Layer 2 frame at every hop |
| Scope | Single broadcast domain | Crosses multiple segments/networks |
| IP address awareness | None | Central to the forwarding decision |
Confusing these two is a common source of misunderstanding early in CCNA study — “switching” in the context of a Layer 2 switch and “the router switching function” are related in name only, describing fundamentally different mechanisms operating at different layers.
Troubleshooting Notes
A device seems unreachable despite a correct IP configuration: since MAC addresses are rebuilt at every hop, a Layer 2 problem at any single point along the path — an ARP failure, an incorrect static ARP entry, a Layer 2 loop — can block connectivity even though every device’s own IP configuration is completely correct. Checking show arp on the relevant router narrows down whether the issue is Layer 2 resolution specifically, rather than routing.
Packet capture shows unexpected MAC addresses at an intermediate hop: this is expected behavior, not a bug — remember that MAC addresses are only ever relevant for the current segment. Seeing an intermediate router’s own interface MAC address rather than the original source or final destination device’s MAC address is exactly what the switching function is supposed to produce, and it’s a useful mental check whenever a capture’s MAC addresses don’t match your initial assumption.
A serial link shows no MAC address in a capture: also expected, not a fault — as covered above, point-to-point links using HDLC or PPP simply don’t carry MAC addressing, since there’s no ambiguity about the destination to resolve.
FAQs
What is the difference between encapsulation and de-encapsulation in router switching?
Encapsulation wraps a Layer 3 packet with a Layer 2 header and trailer, preparing it for transmission over a specific medium. De-encapsulation is the reverse process, stripping that Layer 2 framing away to expose the Layer 3 packet so the router can read its destination IP address and make a forwarding decision.
Why do MAC addresses change at each router hop?
MAC addresses are Layer 2 addresses, scoped to a single network segment, so a new pair is needed every time a packet crosses onto a different segment. Since a typical multi-hop path crosses several distinct Layer 2 segments, the MAC addresses get completely rebuilt at each one, even though the underlying Layer 3 packet inside stays the same.
How does a routing table help in router switching?
The routing table stores the best known path to each destination network, and the router consults it specifically using the packet’s destination IP address to determine which outgoing interface to use. Without a matching entry, the router can’t forward the packet at all, regardless of how correctly the Layer 2 framing is handled.
Why don’t IP addresses change during packet forwarding?
IP addresses identify the ultimate source and destination across the entire network, and they need to stay constant precisely so the packet reaches its intended recipient regardless of how many routers it passes through along the way. Only the Layer 2 addressing, relevant to just the current segment, changes hop by hop.
What is the role of ICMP in router switching?
ICMP provides diagnostic and error messaging — ping and traceroute are the most common examples — and packets like ICMP echo requests follow exactly the same encapsulation, routing, and re-encapsulation process as any other IP traffic as they cross the network. ICMP is a useful tool specifically for verifying that the switching function described in this guide is actually working correctly end to end.
Why don’t serial links between routers show MAC addresses?
Serial links are point-to-point connections with exactly one possible recipient on the other end, so there’s no ambiguity to resolve the way there is on a shared, multi-access network like Ethernet. Protocols like HDLC and PPP, commonly used on serial links, simply don’t include MAC addressing in their frame structure at all, since it isn’t needed.
