You will only usually only know the MAC address of the last hop since a new layer 2 frame is generated every time a packet hits a switch or router. For example

You will only usually only know the MAC address of the last hop since a new layer 2 frame is generated every time a packet hits a switch or router. For example if I watch the source MAC address of incoming HTTP requests to my server it always reports the MAC address as being the one for the router/firewall in front of the server even though the source IP addresses will vary. The only way I can think this would be possible to achieve would be to require a signed certificate and HMAC (message authentication code) from the the originating client to be sent with every IP packet and make sharing private keys a serious criminal offence. Even then it would probably be basically unenforceable on any kind of scale.