IP Routing in Investigations

Information Assurance, Incident Response, Digital Forensic investigations depend on understanding how packets are built to indicate the source of the attack.

So, if we need to complete a frame with destination MAC address, we need to broadcast ARP packets to ask for that DLL layer info.  If the IP is not located on the local network, then we'll get the default gateway's MAC address in order to complete the frame.  So, we froward the frame to the default gateway and let the router locate the destination.  Therefore, if the frame comes to us with a MAC address of the default router, the packet is coming from the outside, but if it is coming from a MAC address that we can see in our ARP table, then it is an internal source. 

This is a crucial skill to understand if you want to be successful in these fields. 

Try it yourself:  
1. Ping another computer on your network
2. Type ARP - a and see the IP - MAC mapping
3. You will see the MAC and IP address of the other computer
4. Then ping www.google.com or another website outside your network
5. Look at your ARP - A table again
6. This time, you will see the MAC address of the default router not google