Source and Destination IP of TCP connection

Question

Five Tuple Identifier of TCP connection is (TCP, local IP, local port, remote IP, remote port).

I have made 3 computers in virtual box and set BOX1 for client, BOX2 for median, and BOX3 for server. And made interfaces between them to communicate.

So I have executed the server program on BOX3 and client program in BOX1. The client program calls 10.0.2.2.

When I captured packets from BOX1 and BOX3, the IP Source and Destination IP address was like this.

BOX1's SYN
Src : 10.0.1.2
Dest : 10.0.2.2

BOX3's SYN
Src : 10.0.1.2
Dest : 10.0.2.2

What I have thought is that in BOX1, Src must be 10.0.1.2 and Dest must be 10.0.1.1. And in BOX3, it must be 10.0.2.1 for Src and 10.0.2.2 for Dest. Because BOX1 communicates with BOX2 and BOX3 commuicates with BOX2.

Why does IP is like that?

Thanks for your help.

Answer 1

If you consider the format of the TCP-IP datagram.

Source Address: The 32-bit IP address of the originator of the datagram. Note that even though intermediate devices such as routers may handle the datagram, they do not normally put their address into this field—it is always the device that originally sent the datagram.

Destination Address: The 32-bit IP address of the intended recipient of the datagram. Again, even though devices such as routers may be the intermediate targets of the datagram, this field is always for the ultimate destination.

You can get more understanding here.