MAC address and IP on a LAN

Question

I've made a capture of a FTP session between my computer and a server. The result of a single packet is as follow:

Ethernet II, Src: 00:80:5f:31:d9:7c, Dst: 00:01:f4:96:50:7f
Internet Protocol, Src Addr: 164.0.0.130 (164.0.0.130), Dst Addr: 10.0.0.20 (10.0.0.20)
Transmission Control Protocol, Src Port: ftp (21), Dst Port: 32769 (32769), Seq: 81, Ack: 35, Len: 19

My questions:

1) Is There a router/switcher between these 2 hosts because they are on different networks?
2) Are both MAC addresses real (the host MAC address)? Or one of them is from the router/switcher?
3) The same as above for IP address. Are they real? Both?

P.S: I don't have information about the LAN, routers, switchers, etc. The capture file is all the information I have.

Accepted Answer

1.) Yes, there is a router between the machines. Signs: different subnet and the MAC address of an Enterasys Networks component (00:01:F4 - most certainly the router). Another option would be Proxy ARP (please google that), but even then, there is 'something' between src and dst.

2.) 00:80:5f is HP which is probably your Client PC: 10.0.0.20. 00:01:F4 is Enterasys Networks, which is the next hop router for 10.0.0.20 (see routing table on the client). You won't see the switch mac address, until you talk to one of it's ip addresses (e.g. mgmt interface).

3.) All IP addresses are just virtual data, made of bits and bytes, so both are "unreal" ;-) Honestly: what do you mean by "real" IP address? If you want to detect if there is IP spoofing in place, then that's hard to detect (often impossible) in a capture file and certainly impossible with just a few bytes one ip packet.

Regards
Kurt