Day 12: Life of a Packet

Life of a Packet

Overview

What is the "Life of a Packet"?

The life of a packet traces the complete journey of a single packet as it travels from source to destination across multiple networks, through switches and routers, with different headers being applied and modified at each stage.

Core Principle:

A packet passes through many network devices and may traverse multiple networks. As it travels:

IP addresses (Layer 3) NEVER change — they identify the source and destination hosts
MAC addresses (Layer 2) CHANGE at every hop — they identify the current sender and next receiver

This distinction is critical for understanding how networks actually work.

The Big Picture: Layer 3 vs Layer 2

IP Addresses (Layer 3) — End-to-End

IP addresses remain CONSTANT throughout the packet's journey.

SOURCE IP: 192.168.1.100

DESTINATION IP: 192.168.2.100

These never change, no matter how many routers the packet passes through.

They identify the ultimate SOURCE and DESTINATION hosts.

Purpose: Tell routers where the packet needs to go (the final destination)

Used by: Routers to make forwarding decisions

MAC Addresses (Layer 2) — Hop-by-Hop

MAC addresses CHANGE at every hop — new source and destination at each step.

Each interface on a network device (router, switch) has its OWN MAC address.

As a packet travels, different interfaces add their own MAC addresses.

Hop 1: Source MAC = PC's NIC, Destination MAC = Router's G0/0 interface

Hop 2: Source MAC = Router's G0/1 interface, Destination MAC = Next Router's interface

Hop 3: Source MAC = Next Router's interface, Destination MAC = Destination host's NIC

Purpose: Tell the next device where to send the frame (the immediate next hop)

Used by: Switches to forward within LANs, routers to forward between LANs

Why This Matters

Analogy: Sending a letter through the mail

IP Address = Your home address + recipient's home address

(Written on the envelope, never changes)

MAC Address = Current postal worker + Next postal facility

(Changes at each facility — each worker adds/removes their stamp)

Packet Structure Review

Layers of Encapsulation

┌─────────────────────────────────────┐

│ Application Data (HTTP, etc) │

├─────────────────────────────────────┤

│ TCP/UDP Header (Source Port, │

│ Destination Port, Sequence, etc) │ ← Layer 4 PDU

├─────────────────────────────────────┤

│ IPv4 Header (Source IP, │

│ Destination IP, TTL, Protocol) │ ← Layer 3 PDU / IP Packet

├─────────────────────────────────────┤

│ Ethernet Header (Dest MAC, │

│ Source MAC, Type) │ ← Layer 2 PDU / Ethernet Frame

│ Ethernet Trailer (FCS) │

└─────────────────────────────────────┘

Field Order Matters!

Critical observation: The fields appear in a specific order

In TCP Header:

[Source IP] [Destination IP] [Source Port] [Destination Port]

↑ ↑

Source comes FIRST

In Ethernet Header:

[Destination MAC] [Source MAC] [Type]

↑ ↑

Destination comes FIRST (opposite of Layer 3!)

This is important because it shows the different perspectives:

Layer 3 focuses on the ultimate destination (where are we going?)
Layer 2 focuses on the immediate next hop (who am I sending to right now?)

Detailed Journey: Packet Travels Through Network

Scenario Setup

[Router B]

10.0.0.2

WAN Link

PC A ─[Switch]─ [Router A] ─────────── [Switch] ─── PC B

192.168.1.100 10.0.0.1 192.168.2.100

10.0.0.2

Network A:

- PC A: IP 192.168.1.100, MAC AAAA.AAAA.AAAA

- Router A G0/0: IP 192.168.1.1, MAC 1111.1111.1111

- Router A G0/1: IP 10.0.0.1, MAC 2222.2222.2222

WAN Link:

- Router B G0/0: IP 10.0.0.2, MAC 3333.3333.3333

Network B:

- Router B G0/1: IP 192.168.2.1, MAC 4444.4444.4444

- PC B: IP 192.168.2.100, MAC BBBB.BBBB.BBBB

Task: PC A sends HTTP packet to PC B

Step-by-Step Packet Journey

Step 1: PC A Creates the Packet

PC A (192.168.1.100) initiates an HTTP request to PC B (192.168.2.100)

First, PC A checks if 192.168.2.100 is on the same network:

PC A's IP: 192.168.1.100/24

Network: 192.168.1.0/24 (host 100 is in this network)

Destination: 192.168.2.100/24

Network: 192.168.2.0/24 (different network!)

Conclusion: 192.168.2.100 is NOT on my local network

Action: Send to default gateway (router)

PC A needs Router A's MAC address (192.168.1.1)

PC A sends ARP REQUEST:

"Who has 192.168.1.1? Tell 192.168.1.100"

Router A responds with ARP REPLY:

"I have 192.168.1.1. My MAC is 1111.1111.1111"

PC A learns: Router A's MAC = 1111.1111.1111

PC A creates the packet:

┌─────────────────────────────────────────┐

│ Application Data (HTTP Request) │

├─────────────────────────────────────────┤

│ TCP Header │

│ Source Port: 50000 │

│ Destination Port: 80 │

├─────────────────────────────────────────┤

│ IPv4 Header │

│ Source IP: 192.168.1.100 ← CONSTANT

│ Destination IP: 192.168.2.100 ← CONSTANT

│ TTL: 64 ← Will decrement

├─────────────────────────────────────────┤

│ Ethernet Header │

│ Destination MAC: 1111.1111.1111 ← Router A

│ Source MAC: AAAA.AAAA.AAAA ← PC A

│ Type: 0x0800 (IPv4) │

├─────────────────────────────────────────┤

│ Ethernet Trailer (FCS) │

└─────────────────────────────────────────┘

Key Point: IP addresses are already set — they will NOT change during transit!

Step 2: Packet Travels on Network A (Local LAN)

PC A sends the frame out on the Ethernet to all devices on the switch

Switch processing:

Switch receives frame on port with PC A

↓

Examines Destination MAC: 1111.1111.1111

↓

Looks in MAC address table: "Where is 1111.1111.1111?"

↓

MAC table shows: 1111.1111.1111 is on port connected to Router A

↓

Action: Forward frame out that port only (known unicast)

Router A receives the frame on interface G0/0

Router A receives frame on G0/0

↓

Examines Ethernet Destination MAC: 1111.1111.1111

↓

Checks local interfaces: "Is this MY MAC? Yes!"

↓

Action: Strip Ethernet header/trailer, examine IPv4 header

Step 3: Router A Processes the Packet

Router A examines the IPv4 header:

Source IP: 192.168.1.100

Destination IP: 192.168.2.100

TTL: 64

Router A's routing table lookup:

"Destination 192.168.2.100... which network? 192.168.2.0/24"

"Where is 192.168.2.0/24? Via next-hop 10.0.0.2"

"That's Router B at 10.0.0.2"

Action: Forward out interface G0/1 toward Router B

Router A decrements TTL:

Original TTL: 64

Decremented: 64 - 1 = 63

New TTL: 63

Router A creates NEW Ethernet header:

This is CRITICAL: The Ethernet header is REPLACED!

Old Ethernet Header (from Network A):

Destination MAC: 1111.1111.1111 (Router A's G0/0)

Source MAC: AAAA.AAAA.AAAA (PC A's NIC)

New Ethernet Header (for WAN Link):

Destination MAC: 3333.3333.3333 ← Router B's G0/0

Source MAC: 2222.2222.2222 ← Router A's G0/1

Type: 0x0800 (IPv4)

IPv4 Header (UNCHANGED):

Source IP: 192.168.1.100 ← STILL THE SAME

Destination IP: 192.168.2.100 ← STILL THE SAME

TTL: 63 ← Decremented

Visualization of what happened:

Before Router A processing:

┌─────────────────────────┐

│ Application Data (HTTP) │

├─────────────────────────┤

│ TCP Header │

├─────────────────────────┤

│ IPv4 Header │

│ Src: 192.168.1.100 │

│ Dst: 192.168.2.100 │

│ TTL: 64 │

├─────────────────────────┤

│ Eth Header (OLD) │

│ Dst MAC: 1111.1111.1111 │

│ Src MAC: AAAA.AAAA.AAAA │

└─────────────────────────┘

After Router A processing:

┌─────────────────────────┐

│ Application Data (HTTP) │

├─────────────────────────┤

│ TCP Header │

├─────────────────────────┤

│ IPv4 Header │

│ Src: 192.168.1.100 ✓ │

│ Dst: 192.168.2.100 ✓ │

│ TTL: 63 │

├─────────────────────────┤

│ Eth Header (NEW) │

│ Dst MAC: 3333.3333.3333 │

│ Src MAC: 2222.2222.2222 │

└─────────────────────────┘

Step 4: Packet Travels on WAN Link

Router A sends the new frame toward Router B

Router B receives the frame on interface G0/0

Router B receives frame on G0/0

↓

Examines Ethernet Destination MAC: 3333.3333.3333

↓

Checks local interfaces: "Is this MY MAC? Yes!"

↓

Action: Strip Ethernet header/trailer, examine IPv4 header

Step 5: Router B Processes the Packet

Router B examines the IPv4 header:

Source IP: 192.168.1.100 ← Still PC A!

Destination IP: 192.168.2.100 ← Still PC B!

TTL: 63

Router B's routing table lookup:

"Destination 192.168.2.100... which network? 192.168.2.0/24"

"Is 192.168.2.0/24 directly connected to me? Yes! On G0/1"

Action: Forward directly out interface G0/1

Router B decrements TTL:

Original TTL: 63

Decremented: 63 - 1 = 62

New TTL: 62

Router B creates NEW Ethernet header:

This time, destination is directly connected:

Old Ethernet Header (from WAN):

Destination MAC: 3333.3333.3333 (Router B's G0/0)

Source MAC: 2222.2222.2222 (Router A's G0/1)

Router B needs PC B's MAC address:

Sends ARP REQUEST: "Who has 192.168.2.100? Tell me"

PC B responds: "I have 192.168.2.100. My MAC is BBBB.BBBB.BBBB"

Router B learns: PC B's MAC = BBBB.BBBB.BBBB

New Ethernet Header (for Network B):

Destination MAC: BBBB.BBBB.BBBB ← PC B's NIC

Source MAC: 4444.4444.4444 ← Router B's G0/1

Type: 0x0800 (IPv4)

IPv4 Header (UNCHANGED):

Source IP: 192.168.1.100 ← STILL THE SAME

Destination IP: 192.168.2.100 ← STILL THE SAME

TTL: 62 ← Decremented again

Step 6: Packet Travels on Network B (Local LAN)

Router B sends the frame out on the Ethernet to switch on Network B

Switch processes:

Switch receives frame on port with Router B

↓

Examines Destination MAC: BBBB.BBBB.BBBB

↓

Looks in MAC address table: "Where is BBBB.BBBB.BBBB?"

↓

MAC table shows: BBBB.BBBB.BBBB is on port connected to PC B

↓

Action: Forward frame out that port only

PC B receives the frame

PC B's NIC receives frame

↓

Examines Ethernet Destination MAC: BBBB.BBBB.BBBB

↓

Checks: "Is this MY MAC? Yes!"

↓

Action: Accept frame, strip Ethernet header/trailer

↓

Examine IPv4 header

Step 7: PC B Processes the Packet

PC B examines the IPv4 header:

Source IP: 192.168.1.100 ← Where did this come from

Destination IP: 192.168.2.100 ← This is MY IP

TTL: 62

Router processing: "Is this packet destined for ME? Yes!"

Action: Don't forward, hand to Layer 4 (TCP)

PC B examines the TCP header:

Source Port: 50000 (from PC A)

Destination Port: 80 (HTTP)

TCP processing: "Is port 80 open? Yes, web server is listening"

Action: Pass to HTTP application (web browser or server)

PC B's HTTP application receives the data

Application layer processes the HTTP request

Web server generates HTTP response

Response is sent back toward PC A (reverse journey)

Summary: MAC Addresses vs IP Addresses

What Changed / What Stayed the Same

PC A Router A Router B PC B

↓ ↓ ↓ ↓

Ethernet Header:

Dest MAC AAAA→1111 AAAA→3333 3333→BBBB

Src MAC AAAA←AAAA 2222←2222 4444←4444

↓↓ ↓↓ ↓↓

CHANGED CHANGED CHANGED at each hop

IPv4 Header:

Src IP 192.168.1.100 → 192.168.1.100 → 192.168.1.100 → 192.168.1.100

↓↓

NEVER CHANGES - Identifies ultimate source

Dst IP 192.168.2.100 → 192.168.2.100 → 192.168.2.100 → 192.168.2.100

↓↓

NEVER CHANGES - Identifies ultimate destination

TTL 64 → 63 → 62 → 61

↓↓ ↓↓

DECREMENTED at each router hop

Key Concepts: Why MAC Changes, IP Doesn't

IP Addresses: End-to-End Navigation

IP addresses define the final destination:

"I am PC A (192.168.1.100) and I want to send this to PC B (192.168.2.100)"

This information MUST be in every packet so that:

1. Routers know the ultimate destination

2. The destination knows it was for them

3. Response packets can find the way back

Changing IP addresses would mean:

- Routers wouldn't know where to send it

- Destination wouldn't know who to respond to

MAC Addresses: Local Hop Navigation

MAC addresses define the CURRENT hop:

"Right now, send this to the interface that's my next hop"

At each hop:

- Router A says: "Send to Router B at 10.0.0.2 (MAC: 3333.3333.3333)"

- Router B says: "Send to PC B at 192.168.2.100 (MAC: BBBB.BBBB.BBBB)"

Changing MAC addresses at each hop means:

- Devices know which interface to send the frame to immediately

- Each interface in a router gets its own MAC address

- The destination MAC changes based on the next hop

Analogy: Package Delivery

Package Contents:

From: 123 Main St (IP address) ← Never changes

To: 456 Oak Ave (IP address) ← Never changes

Delivery Process:

Postman A: "Take to Postal Hub B" (MAC address)

Hub B Postman: "Take to Postal Hub C" (MAC address)

Hub C Postman: "Take to 456 Oak Ave" (MAC address)

Each postman (router) has different address (MAC) for next hop

But the package's original and final addresses never change

Packet Journey with Port Numbers

Understanding Port Numbers (Layer 4)

Port numbers also remain constant throughout the journey.

Source Port: 50000 (from PC A - random ephemeral port)

Destination Port: 80 (HTTP service on PC B)

These identify the specific application/service:

- Port 80 = HTTP web server

- Port 443 = HTTPS web server

- Port 22 = SSH

- Port 23 = Telnet

- Ports 49152-65535 = Ephemeral (temporary, assigned by OS)

Why Ports Don't Change

Like IP addresses, port numbers identify the endpoint services.

If routers changed port numbers, the destination wouldn't know

which service the packet was meant for.

Routers don't care about port numbers (they're Layer 4).

Routers only care about:

- Layer 3: Destination IP (where to forward)

- Layer 2: Destination MAC (which interface to use)

TTL and the Journey

TTL Decrements at Each Router

PC A sends with TTL = 64

Router A:

Receives TTL = 64

Decrements: 64 - 1 = 63

Forwards with TTL = 63

Router B:

Receives TTL = 63

Decrements: 63 - 1 = 62

Forwards with TTL = 62

PC B:

Receives with TTL = 62

(Doesn't decrement - destination doesn't forward)

Why TTL Matters

Prevents infinite loops:

If routing loop exists (Router A → Router B → Router A):

TTL = 64 at Router A

TTL = 63 after Router B

TTL = 62 at Router A again

TTL = 61 after Router B

... continues ...

TTL = 1 at Router A

TTL = 0 after Router B → DROPPED

Packet never circulates infinitely, consuming bandwidth

Complete Packet at Each Stage

Stage 1: PC A Creates (Network A)

Ethernet Header:

├─ Dest MAC: 1111.1111.1111 (Router A G0/0)

├─ Src MAC: AAAA.AAAA.AAAA (PC A)

└─ Type: 0x0800

IPv4 Header:

├─ Src IP: 192.168.1.100

├─ Dst IP: 192.168.2.100

├─ TTL: 64

└─ Protocol: 6 (TCP)

TCP Header:

├─ Src Port: 50000

├─ Dst Port: 80

├─ Sequence: [value]

└─ Flags: [SYN]

HTTP Data: "GET / HTTP/1.1..."

Stage 2: Router A Forwards (WAN)

Ethernet Header:

├─ Dest MAC: 3333.3333.3333 (Router B G0/0) ← CHANGED

├─ Src MAC: 2222.2222.2222 (Router A G0/1) ← CHANGED

└─ Type: 0x0800

IPv4 Header:

├─ Src IP: 192.168.1.100 ← SAME

├─ Dst IP: 192.168.2.100 ← SAME

├─ TTL: 63 ← DECREMENTED

└─ Protocol: 6 (TCP) ← SAME

TCP Header: (UNCHANGED)

├─ Src Port: 50000

├─ Dst Port: 80

├─ Sequence: [value]

└─ Flags: [SYN]

HTTP Data: (UNCHANGED) "GET / HTTP/1.1..."

Stage 3: Router B Forwards (Network B)

Ethernet Header:

├─ Dest MAC: BBBB.BBBB.BBBB (PC B) ← CHANGED

├─ Src MAC: 4444.4444.4444 (Router B G0/1) ← CHANGED

└─ Type: 0x0800

IPv4 Header:

├─ Src IP: 192.168.1.100 ← SAME

├─ Dst IP: 192.168.2.100 ← SAME

├─ TTL: 62 ← DECREMENTED

└─ Protocol: 6 (TCP) ← SAME

TCP Header: (UNCHANGED)

├─ Src Port: 50000

├─ Dst Port: 80

├─ Sequence: [value]

└─ Flags: [SYN]

HTTP Data: (UNCHANGED) "GET / HTTP/1.1..."

Stage 4: PC B Receives

Ethernet Header: (Stripped off)

IPv4 Header: (Examined and passed to TCP)

├─ Src IP: 192.168.1.100 ← Identifies who sent it

├─ Dst IP: 192.168.2.100 ← "This is for me!"

├─ TTL: 62

└─ Protocol: 6 (TCP) ← "Pass to TCP handler"

TCP Header: (Examined and passed to HTTP)

├─ Src Port: 50000 ← "From where?"

├─ Dst Port: 80 ← "To HTTP service"

├─ Sequence: [value]

└─ Flags: [SYN] ← "Connection attempt"

HTTP Application: (Processes request)

"GET / HTTP/1.1 from PC A... Generate response"

Key Takeaways for CCNA

✅ IP addresses NEVER change during transit — they identify source and destination hosts

✅ MAC addresses CHANGE at every hop — they identify the current sender and next receiver

✅ Each router interface has a unique MAC address for its local network segment

✅ Routers decrement TTL by 1 at each hop to prevent infinite loops

✅ Ethernet destination MAC comes BEFORE source MAC in the header (opposite of Layer 3)

✅ Port numbers stay constant throughout the journey (identify services/applications)

✅ Routers use destination IP to determine where to forward packets

✅ Routers need destination MAC to know which interface to send the frame to

✅ If destination not directly connected, router uses next-hop IP (from routing table) to determine destination MAC

✅ Switches use destination MAC to forward frames within LANs; routers replace MAC at each hop

✅ Packet encapsulation remains as it travels — each layer's header is examined then passed down/up

✅ Return packets follow reverse path but go through same address transformations (MAC changes, IP stays same)

✅ ARP resolves IP addresses to MAC addresses when router needs to forward to next hop or final destination

✅ TTL reaching 0 causes packet to be dropped (prevents routing loop packet storms)

✅ Each device on path adds only its own MAC as source — never "hops" across multiple devices in one frame