TechKnowSurge
CompTIA Network+ 1.1 Cisco CCNA 1.13 Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.8 Cisco CCNA 3.2 CompTIA Network+ 2.1 Cisco CCST Networking 4.4 Cisco CCST Cybersecurity 2.2
TechKnowSurge Catalog Videos DEMO: L2 vs L3 Addresses (Wireshark)
VideoNetworkFree

DEMO: L2 vs L3 Addresses (Wireshark)

Wireshark packet captures reveal how Layer 2 MAC addresses and Layer 3 IP addresses serve distinct roles in network communication, with each operating at a different scope during data transmission. A practical, live capture demonstrates how destination addresses differ at each layer and why that distinction matters for routing traffic across networks.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark provides a direct view into how Layer 2 and Layer 3 addressing work together — and differently — during normal network traffic. A live packet capture of web traffic to Wikipedia shows that both the source IP address and the source MAC address originate from the same local machine, which can be confirmed through a standard ipconfig command. The destination IP address resolves to the Wikipedia server somewhere on the public internet, making it a remote Layer 3 target.At the Layer 2 level, however, the destination MAC address does not belong to the Wikipedia server — it belongs to the local default gateway. This is confirmed by checking the ARP table, which maps that MAC address to the gateway's IP. The packet is delivered at Layer 2 only as far as the next hop, meaning the frame is addressed locally even when the ultimate destination is on the other side of the world.As the packet moves beyond the default gateway, the Layer 2 information is stripped and rebuilt at each subsequent router. The Layer 3 IP address stays intact for the entire journey, serving as the persistent identifier of the true destination. The Layer 2 address, by contrast, changes at every hop and may not even be a MAC address at all — depending on the underlying technology connecting one router to the next, a completely different Layer 2 addressing scheme may be in use. This behavior is fundamental to understanding how routed networks function and why the two address types exist as separate, complementary mechanisms.

What you'll learn

What's covered

Layer 2 vs Layer 3 Addressing

Aligned to

CompTIA Network+
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
2.1 Explain characteristics of routing technologies.
Cisco CCNA
1.13 Describe switching concepts
3.2 Determine how a router makes a forwarding decision by default
Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
4.4 Explain basic routing concepts
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis
Cisco CCST Cybersecurity
2.2 Explain how network addresses impact network security

Key terms

Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Layer 2
The Data Link layer of the OSI model, responsible for MAC addressing and frame delivery on a local network.
Layer 3
The Network layer of the OSI model, responsible for logical addressing and routing packets between networks.
Default Gateway
The router that a device uses to send traffic to destinations outside its local network.
Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Router
A network device that forwards data packets between networks based on IP addresses.
Hop
A single step in the path a packet takes through the network, specifically the transit from one router to the next closest router toward the destination. The number of hops a packet must travel is used as a routing metric by distance-vector protocols like RIP.

Transcript

I thought we could take a look at Wireshark to see what the differences are between layer 2 and layer 3 addresses. What I've done is I pulled up a website, wikipedia.org, and then I actually went to a page, so information is being transferred back and forth. I've looked at one of these frames now, and let's take a look at the layer 2 addressing and the layer 3 addressing and the differences between those two.

The Layer 3 Addresses

Here on layer 3 we've got an address of 192 a, and that is the local machine. Just to prove it to you, I can bring up a command prompt, type in ipconfig, and on here I see that IP address right there. It's a 45 address.

It is going to a destination address of 19835.26.9. If I were to look that up, that is the host address of the Wikipedia site, so that's where this packet is going to.

The Layer 2 Addresses

But from a MAC address standpoint, or a layer 2 standpoint, I've got this address right here, 54 1379 94 5F FFF. It's a hexadecimal number. So where is that? If I look this up, I can do that with ipconfig, and this time I'll do a /all. I'll look at that Wi-Fi interface once again, and with that IP address that's associated with it, it's the MAC address of that machine. So that's no surprise: both the source IP address and the source MAC address are from the same machine. That makes sense so far.

Now what we see is the destination is 18 E8 29 20 5E F7, so that's the destination MAC address. Now what is the destination from a layer 2 standpoint? Let's take a look at that. I'm going to this time type in arp -a to see all of the ARP table that we have, and I can see that this MAC address shows up right here. And the IP address associated with it — does that sound like the default gateway? Let me see. I'm going to type in ipconfig again, and I look at this Wi-Fi connection right here, and that is the default gateway.

What This Tells Us

So there you have it. The layer 3 destination IP address is that remote machine that's somewhere out there in the world, but the destination MAC address is the local default gateway. What's going to happen is that this is going to be sent, from a layer 2 perspective, to that local default gateway. Then at that point in time that information is no longer valid, as it routes that traffic and sends it to its next destination. It gets rid of that layer 1 and layer 2, but it keeps that layer 3, because that layer 3 IP address is going to remain the same until it gets to its destination. It's the MAC address that's going to keep changing for every single hop.

In fact, there might be different technologies along the way, so maybe it's not a MAC address at all. Maybe it's a different type of layer 2 address depending on the technology that's used from one router to the next router. So it's going to change as it goes from layer 3 device to layer 3 device. There's the difference, visually, between a layer 2 address, a MAC address, and a layer 3 IP address.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →