Packet Flow

🌐 The Great Digital Road Trip: Tracing the Life of a Network Packet

An in-depth technical journey of a network packet — from source to destination.

Have you ever wondered what happens between the moment you hit Enter and when a website responds? That tiny fraction of a second hides an entire world of protocols, addresses, and routing logic. This note traces the life of a packet through every phase — from the source host to the destination — revealing how switching, routing, and ARP work together under the TCP/IP model.

🚦 Phase 1: Planning the Journey (PC1 → R1)

Before a packet leaves its home network, it must plan the route.

🔍 Step 1: Locality Check

• PC1 IP: 192.168.1.11/24
• Destination IP: 192.168.3.11

PC1 examines its subnet mask (/24 = 255.255.255.0).

Since 192.168.3.11 is outside the 192.168.1.0/24 network, PC1 realizes the destination is remote.

Hence, it forwards the packet to its default gateway (R1).

Step	Action	Description
1	ARP Request (Broadcast)	PC1 broadcasts: “Who has 192.168.1.1? Tell 192.168.1.11.” (sent to ffff.ffff.ffff)
2	Switch Floods Frame	SW1 floods the broadcast out of all ports except the one it came from.
3	R1 Responds	R1 replies with an ARP reply (unicast) containing its MAC address.
4	Tables Updated	Both R1 and PC1 update their ARP caches. SW1 also learns both MAC addresses.

Now PC1 can encapsulate its Layer 3 IP packet inside a Layer 2 Ethernet frame addressed to R1’s MAC.

🔹 Key Point:

The IP header stays the same (Destination IP = 192.168.3.11),

but the MAC header changes (Destination MAC = R1’s MAC).

🛣️ Phase 2: Traveling the Router Road (R1 → R2 → R3)

Routers act as the border control officers of networks — deciding the next best hop.

🧭 Step 1: R1 — The First Hop

Once R1 receives the frame addressed to its MAC:

1. De-Encapsulation → Removes Layer 2 Ethernet header.

2. Routing Lookup → Finds the most specific route (longest prefix match) for 192.168.3.11.
   • Route points to Next Hop: 192.168.12.2 (R2).
3. ARP for Next Hop → R1 checks its ARP cache for R2’s MAC. If absent, it broadcasts an ARP request.
4. Re-Encapsulation → R1 creates a new Ethernet frame:
   • Source MAC: R1 G0/0
   • Destination MAC: R2 G0/0
   • Payload: Original IP packet (unchanged)

Then forwards it out to R2.

🔹 Important:

Routers rewrite the Layer 2 frame at every hop but never modify the IP header (except TTL).

🚦 Step 2: R2 — The Middleman

R2 performs the same set of operations:

1. De-encapsulates the frame.

2. Looks up 192.168.3.0/24 in its routing table.

3. Determines next hop: 192.168.23.2 (R3).

4. Uses ARP to find R3’s MAC.

5. Re-encapsulates and forwards the packet.

At this point:

• The IP address still says “To: 192.168.3.11.”

• But the MAC header is now R2 → R3.

🏡 Phase 3: Final Delivery (R3 → PC3)

When the packet reaches the final router (R3):

1. Routing Table Lookup:
   • R3 identifies 192.168.3.0/24 as a directly connected network.
2. ARP for Destination Host:
   • If R3 doesn’t know PC3’s MAC, it sends an ARP broadcast asking for it.
3. Final Frame Creation:
   • Source MAC: R3 interface MAC
   • Destination MAC: PC3 MAC
4. Forwarding:
   • SW2 forwards the frame out the port connected to PC3.

PC3 receives the packet, processes it (for example, as an ICMP Echo Request), and sends an ICMP Echo Reply back to PC1 — retracing the entire process in reverse.

⚡ Technical Sidebar: High-Speed Forwarding with Tag Switching

Traditional routing performs IP lookups (longest prefix match) — which is CPU-intensive. To optimize this, large-scale networks use Tag Switching (the foundation of MPLS – Multiprotocol Label Switching).

Concept	Description
Tag/Label	A short fixed-length identifier carried by the packet.
TIB (Tag Information Base)	Table mapping incoming tags to outgoing tags and interfaces.
Operation	Router swaps tags (label switching) instead of performing full routing lookups.
Advantage	Faster packet forwarding and better scalability.

This allows a separation of forwarding (data plane) from routing logic (control plane) — improving efficiency and performance in service provider networks.

🧩 Layer-by-Layer Role in Packet Flow

Device	Function	MAC Address Destination
PC1 (Source)	Determines if destination is local/remote; sends ARP request for gateway.	Default Gateway’s MAC
SW1 (Switch)	Learns and stores MAC addresses in its table; forwards frames based on destination MAC.	N/A (Transparent)
R1, R2 (Routers)	De-encapsulate frames, perform routing lookups, re-encapsulate with next hop MAC.	Next Hop Router’s MAC
R3 (Final Router)	Recognizes directly connected destination; ARPs for PC3’s MAC.	Destination Host’s MAC
PC3 (Destination)	Processes received packet and generates reply.	Its Own MAC

🔄 Summary: The Lifecycle of a Packet

Layer	Operation	Key Concept
Layer 2 (Data Link)	Framing, MAC addressing, ARP	Local delivery between devices
Layer 3 (Network)	IP addressing, routing decisions	End-to-end logical addressing
Layer 4 (Transport)	TCP/UDP headers	Ensures reliability and port communication
Layer 7 (Application)	HTTP, DNS, etc.	User-level data transfer

In essence:

• The IP address remains constant end-to-end.
• The MAC address changes at every hop.
• Switches handle Layer 2 forwarding.
• Routers handle Layer 3 routing.
• Together, they ensure data travels from source to destination — no matter how complex the journey.

💡 Interview Takeaways

• ARP resolves IP-to-MAC mappings within local networks.
• Routers rewrite Layer 2 headers for each hop, but IP headers stay the same.
• Switches operate purely on MAC addresses and are unaware of IPs.
• Routing table lookup uses the longest prefix match rule.
• Tag Switching (MPLS) enhances speed by decoupling forwarding from routing.
• TTL (Time To Live) prevents routing loops by decrementing at each hop.
• ICMP plays a key role in testing and error reporting (e.g., ping, traceroute).

🧠 For Quick Revision

• Layer 2 = Local delivery
• Layer 3 = Global routing
• ARP = Find the next hop MAC
• Switch = MAC-based forwarding
• Router = IP-based decision-making
• Tag Switching/MPLS = High-speed path forwarding

🙌 Connect With Me