First, the essential ideas
- IPv4 address and mask
- An IPv4 address identifies an interface. A mask separates its network part from its host part. /24 means 255.255.255.0; /30 means 255.255.255.252 and gives two usable host addresses here.
- Default gateway and route
- A host sends traffic for another subnet to its default gateway, a local router interface. A route tells a router which next device can reach a destination network.
- MAC address and ARP
- A MAC address identifies an Ethernet interface on its local segment. Address Resolution Protocol (ARP) discovers the MAC address associated with a local IPv4 next hop.
- Frame, packet and segment
- An Ethernet frame carries an IP packet inside a link header and trailer. A TCP segment is one possible IP payload. This ping lab instead carries an ICMP message directly inside IPv4.
- ICMP and ping
- Internet Control Message Protocol (ICMP) carries diagnostic messages. Ping sends Echo Requests and waits for Echo Replies. A missing reply alone does not identify the fault.
- TTL and checksum
- Time To Live (TTL) limits routed travel. A router reduces it before forwarding. The IPv4 header checksum checks the header for errors and must change when TTL changes.
- Packet capture
- A capture records traffic at one link. Wireshark opens that record and lets you expand Ethernet, IPv4 and ICMP fields to inspect what was actually sent.
Read the device name before typing. In GNS3, right-click that device and choose Console. Type one command per line and press Enter. The router prompt ends in > for basic access, # for privileged access, (config)# for general settings, or (config-if)# for one interface. Prompts are not part of the command. If a line is rejected, stop and check the selected device, spelling, mode and mapped port before continuing.
See the idea
Tracing Encapsulation Changes Hop-by-Hop in a Routed Network
Routers replace Ethernet frames and update IPv4 TTL and its header checksum. Endpoint IP addresses stay unchanged in this lab.
PC1 sends an IP packet
PC1 sends an ICMP request in IPv4: source 192.168.1.10, destination 192.168.2.10. Its Ethernet frame addresses Router1. The Switch forwards it without reducing TTL.
What this model leaves out: The Switch on the first Ethernet segment is omitted for clarity. IP Packet is a data annotation, not a device or extra hop. This lab has no NAT or tunnels.
Full visual explanation and references
Diagram shows packet data traveling from PC1 through Router1 and Router2 to PC2 with encapsulation headers changing at each hop, including MAC address and TTL updates.
The Switch on the first Ethernet segment is omitted for clarity. IP Packet is a data annotation, not a device or extra hop. This lab has no NAT or tunnels.
- PC1 sends an IP packet
PC1 sends an ICMP request in IPv4: source 192.168.1.10, destination 192.168.2.10. Its Ethernet frame addresses Router1. The Switch forwards it without reducing TTL.
www.rfc-editor.org - Router1 updates headers
Router1 reduces TTL and updates the IPv4 header checksum. Endpoint IP addresses stay unchanged. A new Ethernet frame uses Router1's outgoing MAC and Router2's incoming MAC.
www.rfc-editor.org - Router2 updates headers
Router2 reduces TTL again and updates the IPv4 header checksum. It keeps both endpoint IP addresses and builds a new frame from its PC2-facing MAC to PC2's MAC. PC2 receives the request.
www.rfc-editor.org
One idea at a time
Start with something familiar.
An interface is a connection on a device. An IP address identifies it in an IP network; a MAC address identifies it on Ethernet. Read the short definitions above before opening the lab.
Why learn this?
A remote destination can stay the same while each local delivery changes. Separating those facts helps you investigate the correct part of a path.
An everyday comparison
A parcel travels in several delivery vehicles. Each driver delivers to the next transfer point while the parcel keeps its final destination label.
What happens in a network
The changing local delivery represents Ethernet frames. The final destination label represents the destination IP address, which is unchanged in this lab.
Where the comparison stopsRouters do not drive parcels. They read binary fields and also update TTL and the IPv4 header checksum; the packet is not wholly unchanged.
Follow one worked example
- PC1 selects its gateway for remote PC2.
PC1 sends an ICMP request inside IPv4 and an Ethernet frame addressed to Router1; the Switch forwards that frame.
Why: PC2 is outside PC1's /24 subnet, so the first Ethernet receiver must be the gateway.
- Router1 forwards the request toward Router2.
The router replaces the Ethernet frame, decreases TTL and updates the IPv4 header checksum without changing the endpoint IP pair.
Why: The next Ethernet segment needs a different local sender and receiver.
- Router2 forwards the request to PC2.
Router2 builds the final Ethernet frame and updates TTL and checksum again. PC2 receives the ICMP Echo Request and can generate a reply.
Why: PC2 is directly connected to Router2, so it is the final local next hop.
Your first small task
Before configuring devices, draw three rows for the Ethernet segments on paper. Copy the request IP pair into each row and predict each local MAC sender and receiver.
Show a hint
Use interface roles instead of inventing numeric MAC addresses. Phone-only learners can do this prediction; captures still require the hands-on lab.
Check the expected result
All rows contain 192.168.1.10 to 192.168.2.10. Their MAC pairs name PC1/Router1, Router1/Router2 and Router2/PC2 interfaces.
Pause and explain it in your own words
Does a changed Ethernet destination mean that the final IPv4 destination also changed?
Show a hint
Compare the next device on one segment with the final device that should receive the request.
Show the explanation
No. Ethernet names the next local receiver, while IPv4 still names PC2 in this no-NAT lab. Router1 therefore sends a frame to Router2 containing an IPv4 packet still addressed to 192.168.2.10.
Short answer
What should you understand today?
Encapsulation wraps a message in the information needed to deliver it. In this Ethernet lab, a router removes the incoming frame and builds a new frame for its outgoing link. The IPv4 source and destination addresses stay unchanged because there is no address translation. Each forwarding router reduces Time To Live (TTL) and updates the IPv4 header checksum. Compare captures of the same ICMP Echo Request on three links to see these changes; interface status alone cannot show them.
Before you begin
Learning targets
- Complete Day 1 or the start-here guide: open an app, create a project, click a node, and type into its console.
- Recap Day 2: a switch forwards within an Ethernet segment; a router forwards between IP networks.
- Recap Day 4: an interface is a device connection; a console accepts commands; ping tests ICMP reachability, not every application.
- Use an isolated GNS3 desktop project with Wireshark and two entitled Cisco IOS/IOS XE router appliances with two routed Ethernet ports each.
- Distinguish an Ethernet frame, an IPv4 packet, a TCP segment and an ICMP message.
- Trace the same request across two routers using its addresses and ICMP identifier and sequence number.
- Explain why a router replaces the Ethernet frame while preserving endpoint IP addresses in this lab.
- Observe TTL and IPv4 header checksum changes without assuming that interface commands display individual packets.
- Configure and verify both directions of the path, then recover from one controlled interface shutdown.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Encapsulation
Adding a protocol header, and sometimes a trailer, around data for delivery at that layer.
Ethernet frame
The local Ethernet wrapper carrying an IPv4 packet, including MAC addresses and normally a frame check sequence.
IPv4 packet
A network-layer header and payload. The header contains endpoint IP addresses, TTL and a header checksum.
TCP segment
A TCP header and its data. TCP is a transport protocol; the ICMP ping used here does not contain a TCP segment.
ICMP Echo
A diagnostic request/reply exchange used by ping, carried directly inside IP.
TTL
Time To Live: an IPv4 field reduced during router forwarding to bound packet lifetime.
Header checksum
An error-checking value for the IPv4 header. Changing TTL requires updating this value.
MAC address
An address identifying an Ethernet interface on a local segment; different router interfaces have their own values.
ARP
Address Resolution Protocol: a way to find the local Ethernet MAC address associated with an IPv4 next hop.
Default gateway
The local router interface to which a host sends traffic for a remote subnet.
Static route
A manually configured destination network and next hop used by the router to select a forwarding path.
Packet capture
A recorded view of traffic at a link that can be inspected in Wireshark.
Follow one message through its wrappers
Encapsulation adds delivery information around a message. Ethernet uses a frame with local source and destination MAC addresses. Inside that frame, an IPv4 packet names the original sender and final receiver. Applications often use TCP, which carries data in segments, or UDP, which carries datagrams. Ping is different: its ICMP Echo message sits directly inside IPv4, without a TCP segment or UDP datagram. Do not draw a TCP segment around this lab ping. The receiver reads the outer Ethernet information, then the IPv4 information, then the ICMP message. These names describe different layers, not interchangeable names for the same header.
- The lab packet carries ICMP directly inside IPv4, inside Ethernet.
- TCP segments belong to TCP traffic; they are not required for ping.
- A frame describes local delivery while a packet carries network-layer addressing.
Separate the endpoint from the next hop
PC1 is 192.168.1.10/24 and PC2 is 192.168.2.10/24. Their masks place them in different subnets, so PC1 sends this remote traffic to its gateway, Router1 at 192.168.1.1. PC1 uses ARP to learn that gateway interface MAC address. Its Ethernet destination is Router1, while its IPv4 destination is PC2. The built-in Switch forwards the frame within the first segment; it does not route or reduce IP TTL. Router1 selects Router2 at 10.0.0.2 as the next hop. Router2 selects its directly connected PC2 network. Replies need routes in the opposite direction as well. Successful local configuration does not by itself establish the full path.
- The next hop is the immediate receiver on the current segment.
- The final destination remains PC2 for this request throughout the lab.
- The switch-to-router and PC-to-switch cables belong to the same Ethernet segment.
Identify the fields that routers change
In this exercise there is no Network Address Translation (NAT), which would rewrite IP addresses, and no tunnelling. Router1 removes the incoming Ethernet encapsulation and creates an outgoing frame using its own transit-interface MAC as source and Router2's transit-interface MAC as destination. Router2 then uses its PC2-facing interface MAC and PC2's MAC. Interfaces on the same router can have different MAC addresses; record the actual interface value. IPv4 source 192.168.1.10 and destination 192.168.2.10 stay unchanged. The ICMP payload also remains unchanged in normal forwarding. Ethernet frame check sequences belong to each transmitted frame, but many capture paths omit them. Do not treat an absent Ethernet trailer as a broken lab.
- Routers build new Ethernet frames; an ordinary switch does not replace endpoint MAC addresses as a routing hop would.
- Unchanged endpoint IP addresses are a property of this no-NAT lab, not every possible network.
- The IPv4 header checksum and Ethernet frame check sequence protect different headers or frames.
Read TTL and the IPv4 header checksum
TTL is an eight-bit IPv4 field that bounds a packet's lifetime. A forwarding router decreases it by at least one; in this small lab expect one per router. If the remaining value is insufficient to forward, the router discards the packet and normally sends an ICMP Time Exceeded message. Because TTL is in the IPv4 header, changing it requires updating that header's checksum. The checksum covers the IPv4 header, not the entire payload. Do not assume that every sender starts with TTL 64. Observe the first capture and call that value T; the next two captures should normally show T minus 1 and T minus 2. The TTL printed by PC1's ping belongs to an arriving reply, not to its outgoing request.
- Compare one request across capture points rather than comparing unrelated packets.
- A changed TTL requires an updated IPv4 header checksum.
- A single observed TTL does not reveal a hop count unless the starting TTL is known.
Use the right evidence for each question
Router display commands answer configuration questions. show ip interface brief summarizes addresses and interface state. show ip route displays the forwarding routes. show interfaces includes link details and counters. These displays do not show the TTL of every packet crossing the router. Use simultaneous link captures for packet fields. In Wireshark, select the same ICMP Echo Request in each capture, expand Ethernet II, Internet Protocol Version 4 and Internet Control Message Protocol, then record the addresses, TTL and IPv4 header checksum. Packet numbers in the left column are local to each capture file; they are not shared packet identities. This lab does not need packet debugging or forwarding-path changes.
- Interface state and routes explain configuration; captures show packet fields.
- Match Echo Requests by IP pair, ICMP identifier and sequence number, then confirm direction and payload.
- Keep the fault experiment separate from the successful capture baseline.
Real-world walkthrough
Prove what changed between two office networks
A colleague says that every router must change the destination IP because it sends to a different next device. Use the isolated lab to test that claim. In a workplace, request authorized capture evidence and inspect it read-only; do not copy the lab shutdown experiment onto a working network.
- Identify the actual source and final destination of the request before looking at local Ethernet addresses. Here they are 192.168.1.10 and 192.168.2.10.
- At capture A, record PC1 and Router1 LAN MAC addresses. The Switch forwards this same local frame and is not a TTL-decrementing hop.
- At capture B, match the request using its ICMP identifier and sequence. Record Router1 transit and Router2 transit MAC addresses, the unchanged IP pair and the reduced TTL.
- At capture C, find that request again. Record Router2 LAN and PC2 MAC addresses, the unchanged IP pair and the second TTL reduction.
- Compare the IPv4 header checksum as well. It changes with the header; the ICMP payload is not rewritten by ordinary forwarding in this exercise.
- Report only what the evidence establishes. These matched captures describe one ICMP request, not all application traffic or networks with NAT, tunnels or other transformations.
Guided GNS3 lab
Tracing Encapsulation Changes Hop-by-Hop in a Routed Network
Build a disposable Ethernet path from PC1 through Switch, Router1 and Router2 to PC2. Capture the same ICMP request on all three routed segments, compare its frame addresses and IPv4 fields, then test and recover one controlled link fault.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| PC1 | Ethernet0 | 192.168.1.10/24 | First endpoint of communication |
| Router1 | GigabitEthernet0/0 | 192.168.1.1/24 | Router interface toward PC1 |
| Router1 | GigabitEthernet0/1 | 10.0.0.1/30 | Router interface toward Router2 |
| Router2 | GigabitEthernet0/0 | 10.0.0.2/30 | Router interface toward Router1 |
| Router2 | GigabitEthernet0/1 | 192.168.2.1/24 | Router interface toward PC2 |
| PC2 | Ethernet0 | 192.168.2.10/24 | Second endpoint of communication |
Set up the lab
- Create a fresh GNS3 desktop project named CCNA-Day-05. Add two VPCS hosts named PC1 and PC2, one built-in Ethernet Switch, and two fresh IOS/IOS XE router instances named Router1 and Router2. Do not attach Cloud, NAT or external links.
- Use legally entitled router appliances with two routed Ethernet ports each, not Layer 2 switch ports. Before this lab, complete appliance installation and verify both routers boot. If an initial configuration dialog appears, answer no and press Enter to reach the console.
- The example maps Router1 LAN to GigabitEthernet0/0 and transit to GigabitEthernet0/1; Router2 transit to GigabitEthernet0/0 and LAN to GigabitEthernet0/1. Inventory the actual names in steps 1–2 and substitute them consistently in every later command and cable selection. If two routed ports are missing, stop and correct the appliance template.
- Use Add a Link to connect the exact endpoints in the topology. Keep the two used Switch ports in the same default access segment. The built-in Switch has no IOS console; do not type router commands into it. Use Ethernet only, not serial connections.
- Install and open Wireshark before starting. Start all four endpoint/router nodes with the green start control. Right-click a node and choose Console. Keep its GNS3 node name visible so the two router consoles cannot be confused.
- Start only from unused router ports with no IP addresses, NAT, access filters or custom routes. Steps 1–2 confirm this. If existing settings appear, stop and use fresh disposable instances rather than overwrite them. Keep the original project untouched.
- Write the addressing table and port mapping in a separate note. /24 is 255.255.255.0 on the host LANs; /30 is 255.255.255.252 on the router link. PC1 gateway is 192.168.1.1; PC2 gateway is 192.168.2.1. No Internet access is expected.
- Type only command text, one line at a time, followed by Enter. A pager prompt accepts Space for the next page or q to quit. On an error, stop and check the device, mode and port mapping. If a requested password is unknown, resolve your lab access before continuing.
Inspect Router1 before changes
Right-click Router1, choose Console and start at its > or # prompt. Type these lines in this window only. Record the two routed Ethernet ports and their cable roles. Check the full configuration for the clean-start conditions in setup; stop if they are not met.
enable
show ip interface brief
show running-configWhat each command means
enable- enable enters privileged EXEC mode, shown by #, from the basic > prompt. It does not change the configuration. Use only the credentials for your own lab appliance.
show ip interface brief- show ip interface brief lists IPv4 addresses and the status and protocol state of every interface. brief requests the short summary; it does not display packet TTL.
show running-config- show running-config displays the active configuration. Check the mapped ports, routes and any filters; record it without changing or saving it.
- What you should see
- The two selected router interfaces exist and are unaddressed. The active configuration has no conflicting routes, NAT or access filters. You have recorded the actual port-to-role mapping.
- Why this step matters
- Inventory prevents assigning addresses to the wrong device or reusing an interface with settings owned by another exercise.
Inspect Router2 before changes
Right-click Router2, choose Console and start at its > or # prompt. Type these lines in this window only. Record the two routed Ethernet ports and their cable roles. Check the full configuration for the clean-start conditions in setup; stop if they are not met.
enable
show ip interface brief
show running-configWhat each command means
enable- enable enters privileged EXEC mode, shown by #, from the basic > prompt. It does not change the configuration. Use only the credentials for your own lab appliance.
show ip interface brief- show ip interface brief lists IPv4 addresses and the status and protocol state of every interface. brief requests the short summary; it does not display packet TTL.
show running-config- show running-config displays the active configuration. Check the mapped ports, routes and any filters; record it without changing or saving it.
- What you should see
- The two selected router interfaces exist and are unaddressed. The active configuration has no conflicting routes, NAT or access filters. You have recorded the actual port-to-role mapping.
- Why this step matters
- Inventory prevents assigning addresses to the wrong device or reusing an interface with settings owned by another exercise.
Configure Router1 only
Open the Router1 console at # after its inventory step. Apply only this router's lines in order, pressing Enter each time. Replace example interface names with your recorded mapping. The route belongs to global configuration mode, reached after the second exit.
configure terminal
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
ip address 10.0.0.1 255.255.255.252
no shutdown
exit
ip route 192.168.2.0 255.255.255.0 10.0.0.2
endWhat each command means
configure terminal- configure terminal enters global configuration mode, shown by (config)#, so subsequent lines can change this lab router.
interface GigabitEthernet0/0- interface selects the PC1 LAN port, GigabitEthernet0/0, and enters (config-if)# mode. GigabitEthernet names the port type; slash-separated numbers identify its slot and port. Use your verified mapping if different.
ip address 192.168.1.1 255.255.255.0- ip address assigns 192.168.1.1 to this PC1 LAN interface. Mask 255.255.255.0 is /24, making the first three address numbers the network part. The dots separate four decimal address bytes.
no shutdown- no shutdown removes the administrative disable from the selected lab interface. A working cable and running peer are still required for an up/up state.
exit- exit leaves this interface context and returns to global configuration mode; it does not delete the settings.
interface GigabitEthernet0/1- interface selects the transit port, GigabitEthernet0/1, and enters (config-if)# mode. GigabitEthernet names the port type; slash-separated numbers identify its slot and port. Use your verified mapping if different.
ip address 10.0.0.1 255.255.255.252- ip address assigns 10.0.0.1 to this transit interface. Mask 255.255.255.252 is /30, making 10.0.0.0 the transit network with usable hosts .1 and .2. The dots separate four decimal address bytes.
no shutdown- no shutdown removes the administrative disable from the selected lab interface. A working cable and running peer are still required for an up/up state.
exit- exit leaves this interface context and returns to global configuration mode; it does not delete the settings.
ip route 192.168.2.0 255.255.255.0 10.0.0.2- ip route adds a route to remote network 192.168.2.0. Mask 255.255.255.0 selects that /24 network; 10.0.0.2 is the other router's directly reachable transit address, the next hop. This is not an address assigned to the local port.
end- end returns from configuration mode to privileged EXEC, shown by #, for display commands.
- What you should see
- Router1 returns to # with both addresses configured and a static route toward the remote /24 LAN. Verify actual link state in the later display step; no shutdown alone is not proof of connectivity.
- Why this step matters
- Each router needs its own local addressing and a route to the remote LAN. A return route is necessary for the Echo Reply, not just the outgoing request.
Configure Router2 only
Open the Router2 console at # after its inventory step. Apply only this router's lines in order, pressing Enter each time. Replace example interface names with your recorded mapping. The route belongs to global configuration mode, reached after the second exit.
configure terminal
interface GigabitEthernet0/0
ip address 10.0.0.2 255.255.255.252
no shutdown
exit
interface GigabitEthernet0/1
ip address 192.168.2.1 255.255.255.0
no shutdown
exit
ip route 192.168.1.0 255.255.255.0 10.0.0.1
endWhat each command means
configure terminal- configure terminal enters global configuration mode, shown by (config)#, so subsequent lines can change this lab router.
interface GigabitEthernet0/0- interface selects the transit port, GigabitEthernet0/0, and enters (config-if)# mode. GigabitEthernet names the port type; slash-separated numbers identify its slot and port. Use your verified mapping if different.
ip address 10.0.0.2 255.255.255.252- ip address assigns 10.0.0.2 to this transit interface. Mask 255.255.255.252 is /30, making 10.0.0.0 the transit network with usable hosts .1 and .2. The dots separate four decimal address bytes.
no shutdown- no shutdown removes the administrative disable from the selected lab interface. A working cable and running peer are still required for an up/up state.
exit- exit leaves this interface context and returns to global configuration mode; it does not delete the settings.
interface GigabitEthernet0/1- interface selects the PC2 LAN port, GigabitEthernet0/1, and enters (config-if)# mode. GigabitEthernet names the port type; slash-separated numbers identify its slot and port. Use your verified mapping if different.
ip address 192.168.2.1 255.255.255.0- ip address assigns 192.168.2.1 to this PC2 LAN interface. Mask 255.255.255.0 is /24, making the first three address numbers the network part. The dots separate four decimal address bytes.
no shutdown- no shutdown removes the administrative disable from the selected lab interface. A working cable and running peer are still required for an up/up state.
exit- exit leaves this interface context and returns to global configuration mode; it does not delete the settings.
ip route 192.168.1.0 255.255.255.0 10.0.0.1- ip route adds a route to remote network 192.168.1.0. Mask 255.255.255.0 selects that /24 network; 10.0.0.1 is the other router's directly reachable transit address, the next hop. This is not an address assigned to the local port.
end- end returns from configuration mode to privileged EXEC, shown by #, for display commands.
- What you should see
- Router2 returns to # with both addresses configured and a static route toward the remote /24 LAN. Verify actual link state in the later display step; no shutdown alone is not proof of connectivity.
- Why this step matters
- Each router needs its own local addressing and a route to the remote LAN. A return route is necessary for the Echo Reply, not just the outgoing request.
Configure PC1 in VPCS
Right-click PC1 and choose Console. Confirm this is the VPCS window, not a router or your computer's terminal. Enter each line and press Enter. Compare the displayed address, mask and gateway with this host's table row before continuing.
ip 192.168.1.10 255.255.255.0 192.168.1.1
show ipWhat each command means
ip 192.168.1.10 255.255.255.0 192.168.1.1- ip assigns this VPCS host address 192.168.1.10. Mask 255.255.255.0 is /24. The last value, 192.168.1.1, is its local router gateway for remote networks. Dots separate address bytes; spaces separate the three values.
show ip- show ip displays this VPCS host's address, mask, gateway and MAC address. It verifies local settings only; it does not send a reachability test.
- What you should see
- PC1 shows 192.168.1.10/24 and gateway 192.168.1.1. Record its MAC address for the later capture comparison.
- Why this step matters
- Explicit host addressing and gateways make the route usable from the endpoints. Using a router command in VPCS would not configure the intended setting.
Configure PC2 in VPCS
Right-click PC2 and choose Console. Confirm this is the VPCS window, not a router or your computer's terminal. Enter each line and press Enter. Compare the displayed address, mask and gateway with this host's table row before continuing.
ip 192.168.2.10 255.255.255.0 192.168.2.1
show ipWhat each command means
ip 192.168.2.10 255.255.255.0 192.168.2.1- ip assigns this VPCS host address 192.168.2.10. Mask 255.255.255.0 is /24. The last value, 192.168.2.1, is its local router gateway for remote networks. Dots separate address bytes; spaces separate the three values.
show ip- show ip displays this VPCS host's address, mask, gateway and MAC address. It verifies local settings only; it does not send a reachability test.
- What you should see
- PC2 shows 192.168.2.10/24 and gateway 192.168.2.1. Record its MAC address for the later capture comparison.
- Why this step matters
- Explicit host addressing and gateways make the route usable from the endpoints. Using a router command in VPCS would not configure the intended setting.
Verify Router1 forwarding setup
Return to Router1's console at #. Run these displays in order. Compare port addresses with the table and record each interface MAC from its hardware/address line. Require both selected ports to be up/up and the remote static route to be present before the capture experiment.
show ip interface brief
show ip route
show interfaces GigabitEthernet0/0
show interfaces GigabitEthernet0/1What each command means
show ip interface brief- show ip interface brief lists IPv4 addresses and the status and protocol state of every interface. brief requests the short summary; it does not display packet TTL.
show ip route- show ip route lists known IPv4 routes. C marks connected networks, L local interface addresses on supporting releases, and S a configured static route.
show interfaces GigabitEthernet0/0- show interfaces displays status, hardware MAC address and counters for the mapped GigabitEthernet0/0 port. The slash-separated numbers select one port; record that port's MAC, not a generic router MAC.
show interfaces GigabitEthernet0/1- show interfaces displays the same information for the mapped GigabitEthernet0/1 port. Record its separate hardware MAC address for the outgoing or incoming frame comparison.
- What you should see
- Both selected interfaces are up/up. Router1 lists the two connected subnets and an S route to 192.168.2.0/24 via 10.0.0.2. If not, stop and resolve the port, peer or route discrepancy.
- Why this step matters
- These displays establish configuration evidence and local interface identities. They do not show individual request TTL values or prove the full end-to-end exchange.
Verify Router2 forwarding setup
Return to Router2's console at #. Run these displays in order. Compare port addresses with the table and record each interface MAC from its hardware/address line. Require both selected ports to be up/up and the remote static route to be present before the capture experiment.
show ip interface brief
show ip route
show interfaces GigabitEthernet0/0
show interfaces GigabitEthernet0/1What each command means
show ip interface brief- show ip interface brief lists IPv4 addresses and the status and protocol state of every interface. brief requests the short summary; it does not display packet TTL.
show ip route- show ip route lists known IPv4 routes. C marks connected networks, L local interface addresses on supporting releases, and S a configured static route.
show interfaces GigabitEthernet0/0- show interfaces displays status, hardware MAC address and counters for the mapped GigabitEthernet0/0 port. The slash-separated numbers select one port; record that port's MAC, not a generic router MAC.
show interfaces GigabitEthernet0/1- show interfaces displays the same information for the mapped GigabitEthernet0/1 port. Record its separate hardware MAC address for the outgoing or incoming frame comparison.
- What you should see
- Both selected interfaces are up/up. Router2 lists the two connected subnets and an S route to 192.168.1.0/24 via 10.0.0.1. If not, stop and resolve the port, peer or route discrepancy.
- Why this step matters
- These displays establish configuration evidence and local interface identities. They do not show individual request TTL values or prove the full end-to-end exchange.
Start three labelled link captures
In GNS3, right-click the Switch–Router1 link and choose Start capture. Open Wireshark if prompted. Repeat for Router1–Router2 and Router2–PC2. Label your notes A, B and C with each link and keep all three captures running simultaneously. If Wireshark cannot open, fix its GNS3 integration before proceeding. No router command is needed.
- What you should see
- Three capture windows record the first LAN, the transit Ethernet segment and the final LAN. Their titles or notes identify the corresponding link.
- Why this step matters
- Simultaneous captures allow comparison of one request at three places. Capturing a different request on each link would weaken the field comparison.
Send the baseline request from PC1
Open only PC1's VPCS console. Run the peer ping and let it finish. If initial requests time out while ARP resolves, repeat the same command. Obtain successful replies before adding a fault. Keep the captures running for this baseline and record the time of the test.
ping 192.168.2.10What each command means
ping 192.168.2.10- ping sends ICMP Echo Requests to PC2 at 192.168.2.10 and waits for replies. That value is the remote endpoint, not PC1 itself or its gateway. Reply TTL describes the returning reply; it is not the outgoing request TTL.
- What you should see
- PC1 receives Echo Replies from PC2 after both directions are configured. The captures contain requests and replies; missing replies require investigation before the fault test.
- Why this step matters
- A peer ping exercises the routed path in both directions. Self-ping would not prove either router or the links between them work.
Compare the same captured request
In each Wireshark window, click the display-filter bar, type icmp and press Enter; this word displays ICMP traffic without changing the saved capture. Select an Echo Request from 192.168.1.10 to 192.168.2.10. Match its ICMP identifier and sequence number across A, B and C, confirming direction and payload. Expand Ethernet II, Internet Protocol Version 4 and Internet Control Message Protocol in the details pane. Record MAC pairs, IP pairs, TTL and IPv4 header checksum. File packet numbers need not match.
- What you should see
- Endpoint IP addresses agree in A, B and C. MAC pairs follow the three interface pairs taught above. If A has TTL T, B normally has T−1 and C T−2; the IPv4 header checksum changes. Record actual values, not an assumed starting TTL.
- Why this step matters
- Matching a single request ties the field changes to forwarding. ICMP replies are different packets; comparing them to requests can produce a false conclusion about TTL or addressing.
Disable the Router2 PC2-facing port
After recording the working baseline, open Router2 at #. Confirm GigabitEthernet0/1 is your mapped PC2-facing port and no other node uses it. Apply these lines only in the disposable lab. Do not save this temporary fault to startup configuration.
configure terminal
interface GigabitEthernet0/1
shutdown
end
show ip interface briefWhat each command means
configure terminal- configure terminal enters global configuration mode, shown by (config)#, so subsequent lines can change this lab router.
interface GigabitEthernet0/1- interface selects the PC2 LAN port, GigabitEthernet0/1, and enters (config-if)# mode. GigabitEthernet names the port type; slash-separated numbers identify its slot and port. Use your verified mapping if different.
shutdown- shutdown administratively disables only the selected Router2 PC2-facing interface. It intentionally interrupts the final Ethernet segment; it does not delete the IP address.
end- end returns from configuration mode to privileged EXEC, shown by #, for display commands.
show ip interface brief- show ip interface brief lists IPv4 addresses and the status and protocol state of every interface. brief requests the short summary; it does not display packet TTL.
- What you should see
- Router2 reports its PC2-facing interface administratively down. The known baseline now differs by this one deliberate change.
- Why this step matters
- A controlled single change lets you relate configuration evidence to the observed failure, instead of treating every missing ping reply as a routing or TTL problem.
Observe the fault from PC1
Return to PC1's VPCS console and run the same remote test. Record whether it times out or reports an unreachable destination. Do not change addresses or routes in response: the planned cause is Router2's administratively disabled PC2-facing port.
ping 192.168.2.10What each command means
ping 192.168.2.10- ping again targets remote PC2 at 192.168.2.10 using ICMP Echo Requests. Keep the destination identical to the working baseline so the deliberate port shutdown is the only intended difference.
- What you should see
- PC1 no longer receives successful PC2 Echo Replies. A timeout or unreachable message is possible; neither result alone proves that TTL expired.
- Why this step matters
- The known fault explains this experiment, but a real unexplained ping failure still needs port, ARP, route, filtering and endpoint checks.
Restore Router2 and verify recovery
Open Router2 at #. Confirm the mapped PC2 port again, then enter these lines and check for up/up. Next switch to PC1 and repeat the exact ping from step 13 to remote PC2; its meaning is unchanged. Require successful replies again before closing the project. If replies do not return, compare all settings with the recorded working baseline.
configure terminal
interface GigabitEthernet0/1
no shutdown
end
show ip interface briefWhat each command means
configure terminal- configure terminal enters global configuration mode, shown by (config)#, so subsequent lines can change this lab router.
interface GigabitEthernet0/1- interface selects the PC2 LAN port, GigabitEthernet0/1, and enters (config-if)# mode. GigabitEthernet names the port type; slash-separated numbers identify its slot and port. Use your verified mapping if different.
no shutdown- no shutdown removes the administrative disable from the selected lab interface. A working cable and running peer are still required for an up/up state.
end- end returns from configuration mode to privileged EXEC, shown by #, for display commands.
show ip interface brief- show ip interface brief lists IPv4 addresses and the status and protocol state of every interface. brief requests the short summary; it does not display packet TTL.
- What you should see
- Router2's PC2-facing port returns to up/up and the repeated PC1-to-PC2 test receives Echo Replies again. If either check fails, recovery is not yet verified.
- Why this step matters
- Restoring the port removes the deliberate fault. The independent endpoint test confirms that the intended communication recovered, rather than relying on one local status display.
Verify
- Confirm the addressing table against each host's show ip output and each router's show ip interface brief output, using the meanings explained in the configuration steps.
- Require both connected networks and the remote S route on each router. A one-way route is insufficient for successful request/reply communication.
- Require a successful PC1-to-PC2 peer ping before the fault and again after recovery; use the same destination and explained command from steps 10 and 13.
- For one matched Echo Request, record identical endpoint IP addresses, three local MAC pairs, TTL changes and the IPv4 header checksum from captures A, B and C.
- Keep the observations separate: router displays verify settings; packet captures demonstrate field values; successful ping demonstrates ICMP exchange only.
Troubleshoot
- If an interface name is rejected, stop and compare the actual inventory with your role mapping. Do not guess another port or configure a built-in Switch with IOS commands.
- If a port is administratively down outside the planned fault, compare its configuration with the setup step. If it is down/down instead, check the selected cable and running peer; no shutdown cannot repair a wrong cable.
- If peer ping fails, check both VPCS masks and gateways, both router addresses and both static routes. Repeat after initial ARP resolution. Do not conclude that missing replies identify a particular layer.
- If a capture is empty, confirm the link label, running capture and current ping. Clear the display filter to inspect all traffic, then reapply icmp. Match requests, not replies or unrelated file packet numbers.
- If a checksum is flagged unexpectedly, inspect the actual IPv4 header and matching packet before drawing a conclusion. Capture/offload presentation can affect displayed validation; an omitted Ethernet frame check sequence is not evidence of failure.
GNS3 does not provide Cisco software images. Use a Cisco image only when the applicable Cisco license or entitlement legally permits that use, and do not share or redistribute Cisco image files. Cisco CML reference-platform images are licensed for use within CML unless a separate license permits outside use. Cisco Modeling Labs is the official alternative; built-in VPCS and Ethernet switch nodes do not require a Cisco image.
- Verify the Router2 port and peer ping have recovered before stopping any node. Keep your baseline, fault and recovery notes separately.
- Stop each link capture in GNS3 and use Wireshark File > Save As to save labelled capture files if needed. Close their windows after saving.
- Stop all nodes in this disposable project. The exercise does not save router or VPCS startup settings. Keep the project and notes for reference, or delete only this disposable project after confirming its name; never reset shared devices.
Practice set
Answer before you reveal
01What is inside the IPv4 packet used by this ping lab?
Ping uses ICMP directly over IPv4. TCP segments and UDP datagrams are other possible IP payloads, so the general layered model must be adapted to the actual traffic.
02What stays unchanged in the request across both routers?
The Ethernet receiver changes at each routed segment. That does not replace the final IPv4 destination with a next-hop router address.
03Why does the Switch not create an extra TTL decrement?
The two cables on either side of the Switch belong to one segment in this lab. Crossing a switch is not the same operation as crossing a router.
04Why should the IPv4 header checksum differ after forwarding?
The IPv4 header checksum covers the header, not the entire application payload. Ethernet has a separate frame check sequence that may be absent from the capture.
05How can you compare one request across three capture files?
File packet numbers are assigned independently within each capture. A request and its reply are separate packets, even when their ICMP identifiers correspond.
06What does show ip interface brief establish, and what does it not establish?
Use the display for configuration and link-state evidence. Use matched captured requests for packet-field evidence, then verify peer reachability separately.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- In this lab, ICMP sits directly inside IPv4, which sits inside an Ethernet frame.
- The Ethernet MAC pair changes at each router; an ordinary switch is not an additional routing hop.
- Endpoint IPv4 addresses remain unchanged because the exercise has no NAT or tunnels.
- Router forwarding reduces TTL and updates the IPv4 header checksum.
- Use matched captures for packet fields, router displays for settings, and peer ping for ICMP reachability.
- Verify the working baseline, observe one deliberate port fault, and confirm recovery with the original peer test.