Day 12: Life of a Packet
Life of a Packet
Overview
What is the "Life of a Packet"?
The life of a packet traces the complete journey of a single packet as it travels from source to destination across multiple networks, through switches and routers, with different headers being applied and modified at each stage.
Core Principle:
A packet passes through many network devices and may traverse multiple networks. As it travels:
-
IP addresses (Layer 3) NEVER change — they identify the source and destination hosts
-
MAC addresses (Layer 2) CHANGE at every hop — they identify the current sender and next receiver
This distinction is critical for understanding how networks actually work.
The Big Picture: Layer 3 vs Layer 2
IP Addresses (Layer 3) — End-to-End
IP addresses remain CONSTANT throughout the packet's journey.
SOURCE IP: 192.168.1.100
DESTINATION IP: 192.168.2.100
These never change, no matter how many routers the packet passes through.
They identify the ultimate SOURCE and DESTINATION hosts.
Purpose: Tell routers where the packet needs to go (the final destination)
Used by: Routers to make forwarding decisions
MAC Addresses (Layer 2) — Hop-by-Hop
MAC addresses CHANGE at every hop — new source and destination at each step.
Each interface on a network device (router, switch) has its OWN MAC address.
As a packet travels, different interfaces add their own MAC addresses.
Hop 1: Source MAC = PC's NIC, Destination MAC = Router's G0/0 interface
Hop 2: Source MAC = Router's G0/1 interface, Destination MAC = Next Router's interface
Hop 3: Source MAC = Next Router's interface, Destination MAC = Destination host's NIC
Purpose: Tell the next device where to send the frame (the immediate next hop)
Used by: Switches to forward within LANs, routers to forward between LANs
Why This Matters
Analogy: Sending a letter through the mail
IP Address = Your home address + recipient's home address
(Written on the envelope, never changes)
MAC Address = Current postal worker + Next postal facility
(Changes at each facility — each worker adds/removes their stamp)
Packet Structure Review
Layers of Encapsulation
┌─────────────────────────────────────┐
│ Application Data (HTTP, etc) │
├─────────────────────────────────────┤
│ TCP/UDP Header (Source Port, │
│ Destination Port, Sequence, etc) │ ← Layer 4 PDU
├─────────────────────────────────────┤
│ IPv4 Header (Source IP, │
│ Destination IP, TTL, Protocol) │ ← Layer 3 PDU / IP Packet
├─────────────────────────────────────┤
│ Ethernet Header (Dest MAC, │
│ Source MAC, Type) │ ← Layer 2 PDU / Ethernet Frame
│ Ethernet Trailer (FCS) │
└─────────────────────────────────────┘
Field Order Matters!
Critical observation: The fields appear in a specific order
In TCP Header:
[Source IP] [Destination IP] [Source Port] [Destination Port]
↑ ↑
Source comes FIRST
In Ethernet Header:
[Destination MAC] [Source MAC] [Type]
↑ ↑
Destination comes FIRST (opposite of Layer 3!)
This is important because it shows the different perspectives:
-
Layer 3 focuses on the ultimate destination (where are we going?)
-
Layer 2 focuses on the immediate next hop (who am I sending to right now?)
Detailed Journey: Packet Travels Through Network
Scenario Setup
[Router B]
10.0.0.2
|
WAN Link
|
PC A ─[Switch]─ [Router A] ─────────── [Switch] ─── PC B
192.168.1.100 10.0.0.1 192.168.2.100
10.0.0.2
Network A:
- PC A: IP 192.168.1.100, MAC AAAA.AAAA.AAAA
- Router A G0/0: IP 192.168.1.1, MAC 1111.1111.1111
- Router A G0/1: IP 10.0.0.1, MAC 2222.2222.2222
WAN Link:
- Router B G0/0: IP 10.0.0.2, MAC 3333.3333.3333
Network B:
- Router B G0/1: IP 192.168.2.1, MAC 4444.4444.4444
- PC B: IP 192.168.2.100, MAC BBBB.BBBB.BBBB
Task: PC A sends HTTP packet to PC B
Step-by-Step Packet Journey
Step 1: PC A Creates the Packet
PC A (192.168.1.100) initiates an HTTP request to PC B (192.168.2.100)
First, PC A checks if 192.168.2.100 is on the same network:
PC A's IP: 192.168.1.100/24
Network: 192.168.1.0/24 (host 100 is in this network)
Destination: 192.168.2.100/24
Network: 192.168.2.0/24 (different network!)
Conclusion: 192.168.2.100 is NOT on my local network
Action: Send to default gateway (router)
PC A needs Router A's MAC address (192.168.1.1)
PC A sends ARP REQUEST:
"Who has 192.168.1.1? Tell 192.168.1.100"
Router A responds with ARP REPLY:
"I have 192.168.1.1. My MAC is 1111.1111.1111"
PC A learns: Router A's MAC = 1111.1111.1111
PC A creates the packet:
┌─────────────────────────────────────────┐
│ Application Data (HTTP Request) │
├─────────────────────────────────────────┤
│ TCP Header │
│ Source Port: 50000 │
│ Destination Port: 80 │
├─────────────────────────────────────────┤
│ IPv4 Header │
│ Source IP: 192.168.1.100 ← CONSTANT
│ Destination IP: 192.168.2.100 ← CONSTANT
│ TTL: 64 ← Will decrement
├─────────────────────────────────────────┤
│ Ethernet Header │
│ Destination MAC: 1111.1111.1111 ← Router A
│ Source MAC: AAAA.AAAA.AAAA ← PC A
│ Type: 0x0800 (IPv4) │
├─────────────────────────────────────────┤
│ Ethernet Trailer (FCS) │
└─────────────────────────────────────────┘
Key Point: IP addresses are already set — they will NOT change during transit!
Step 2: Packet Travels on Network A (Local LAN)
PC A sends the frame out on the Ethernet to all devices on the switch
Switch processing:
Switch receives frame on port with PC A
↓
Examines Destination MAC: 1111.1111.1111
↓
Looks in MAC address table: "Where is 1111.1111.1111?"
↓
MAC table shows: 1111.1111.1111 is on port connected to Router A
↓
Action: Forward frame out that port only (known unicast)
Router A receives the frame on interface G0/0
Router A receives frame on G0/0
↓
Examines Ethernet Destination MAC: 1111.1111.1111
↓
Checks local interfaces: "Is this MY MAC? Yes!"
↓
Action: Strip Ethernet header/trailer, examine IPv4 header
Step 3: Router A Processes the Packet
Router A examines the IPv4 header:
Source IP: 192.168.1.100
Destination IP: 192.168.2.100
TTL: 64
Router A's routing table lookup:
"Destination 192.168.2.100... which network? 192.168.2.0/24"
"Where is 192.168.2.0/24? Via next-hop 10.0.0.2"
"That's Router B at 10.0.0.2"
Action: Forward out interface G0/1 toward Router B
Router A decrements TTL:
Original TTL: 64
Decremented: 64 - 1 = 63
New TTL: 63
Router A creates NEW Ethernet header:
This is CRITICAL: The Ethernet header is REPLACED!
Old Ethernet Header (from Network A):
Destination MAC: 1111.1111.1111 (Router A's G0/0)
Source MAC: AAAA.AAAA.AAAA (PC A's NIC)
New Ethernet Header (for WAN Link):
Destination MAC: 3333.3333.3333 ← Router B's G0/0
Source MAC: 2222.2222.2222 ← Router A's G0/1
Type: 0x0800 (IPv4)
IPv4 Header (UNCHANGED):
Source IP: 192.168.1.100 ← STILL THE SAME
Destination IP: 192.168.2.100 ← STILL THE SAME
TTL: 63 ← Decremented
Visualization of what happened:
Before Router A processing:
┌─────────────────────────┐
│ Application Data (HTTP) │
├─────────────────────────┤
│ TCP Header │
├─────────────────────────┤
│ IPv4 Header │
│ Src: 192.168.1.100 │
│ Dst: 192.168.2.100 │
│ TTL: 64 │
├─────────────────────────┤
│ Eth Header (OLD) │
│ Dst MAC: 1111.1111.1111 │
│ Src MAC: AAAA.AAAA.AAAA │
└─────────────────────────┘
After Router A processing:
┌─────────────────────────┐
│ Application Data (HTTP) │
├─────────────────────────┤
│ TCP Header │
├─────────────────────────┤
│ IPv4 Header │
│ Src: 192.168.1.100 ✓ │
│ Dst: 192.168.2.100 ✓ │
│ TTL: 63 │
├─────────────────────────┤
│ Eth Header (NEW) │
│ Dst MAC: 3333.3333.3333 │
│ Src MAC: 2222.2222.2222 │
└─────────────────────────┘
Step 4: Packet Travels on WAN Link
Router A sends the new frame toward Router B
Router B receives the frame on interface G0/0
Router B receives frame on G0/0
↓
Examines Ethernet Destination MAC: 3333.3333.3333
↓
Checks local interfaces: "Is this MY MAC? Yes!"
↓
Action: Strip Ethernet header/trailer, examine IPv4 header
Step 5: Router B Processes the Packet
Router B examines the IPv4 header:
Source IP: 192.168.1.100 ← Still PC A!
Destination IP: 192.168.2.100 ← Still PC B!
TTL: 63
Router B's routing table lookup:
"Destination 192.168.2.100... which network? 192.168.2.0/24"
"Is 192.168.2.0/24 directly connected to me? Yes! On G0/1"
Action: Forward directly out interface G0/1
Router B decrements TTL:
Original TTL: 63
Decremented: 63 - 1 = 62
New TTL: 62
Router B creates NEW Ethernet header:
This time, destination is directly connected:
Old Ethernet Header (from WAN):
Destination MAC: 3333.3333.3333 (Router B's G0/0)
Source MAC: 2222.2222.2222 (Router A's G0/1)
Router B needs PC B's MAC address:
Sends ARP REQUEST: "Who has 192.168.2.100? Tell me"
PC B responds: "I have 192.168.2.100. My MAC is BBBB.BBBB.BBBB"
Router B learns: PC B's MAC = BBBB.BBBB.BBBB
New Ethernet Header (for Network B):
Destination MAC: BBBB.BBBB.BBBB ← PC B's NIC
Source MAC: 4444.4444.4444 ← Router B's G0/1
Type: 0x0800 (IPv4)
IPv4 Header (UNCHANGED):
Source IP: 192.168.1.100 ← STILL THE SAME
Destination IP: 192.168.2.100 ← STILL THE SAME
TTL: 62 ← Decremented again
Step 6: Packet Travels on Network B (Local LAN)
Router B sends the frame out on the Ethernet to switch on Network B
Switch processes:
Switch receives frame on port with Router B
↓
Examines Destination MAC: BBBB.BBBB.BBBB
↓
Looks in MAC address table: "Where is BBBB.BBBB.BBBB?"
↓
MAC table shows: BBBB.BBBB.BBBB is on port connected to PC B
↓
Action: Forward frame out that port only
PC B receives the frame
PC B's NIC receives frame
↓
Examines Ethernet Destination MAC: BBBB.BBBB.BBBB
↓
Checks: "Is this MY MAC? Yes!"
↓
Action: Accept frame, strip Ethernet header/trailer
↓
Examine IPv4 header
Step 7: PC B Processes the Packet
PC B examines the IPv4 header:
Source IP: 192.168.1.100 ← Where did this come from
Destination IP: 192.168.2.100 ← This is MY IP
TTL: 62
Router processing: "Is this packet destined for ME? Yes!"
Action: Don't forward, hand to Layer 4 (TCP)
PC B examines the TCP header:
Source Port: 50000 (from PC A)
Destination Port: 80 (HTTP)
TCP processing: "Is port 80 open? Yes, web server is listening"
Action: Pass to HTTP application (web browser or server)
PC B's HTTP application receives the data
Application layer processes the HTTP request
Web server generates HTTP response
Response is sent back toward PC A (reverse journey)
Summary: MAC Addresses vs IP Addresses
What Changed / What Stayed the Same
PC A Router A Router B PC B
↓ ↓ ↓ ↓
Ethernet Header:
Dest MAC AAAA→1111 AAAA→3333 3333→BBBB
Src MAC AAAA←AAAA 2222←2222 4444←4444
↓↓ ↓↓ ↓↓
CHANGED CHANGED CHANGED at each hop
IPv4 Header:
Src IP 192.168.1.100 → 192.168.1.100 → 192.168.1.100 → 192.168.1.100
↓↓
NEVER CHANGES - Identifies ultimate source
Dst IP 192.168.2.100 → 192.168.2.100 → 192.168.2.100 → 192.168.2.100
↓↓
NEVER CHANGES - Identifies ultimate destination
TTL 64 → 63 → 62 → 61
↓↓ ↓↓
DECREMENTED at each router hop
Key Concepts: Why MAC Changes, IP Doesn't
IP Addresses: End-to-End Navigation
IP addresses define the final destination:
"I am PC A (192.168.1.100) and I want to send this to PC B (192.168.2.100)"
This information MUST be in every packet so that:
1. Routers know the ultimate destination
2. The destination knows it was for them
3. Response packets can find the way back
Changing IP addresses would mean:
- Routers wouldn't know where to send it
- Destination wouldn't know who to respond to
MAC Addresses: Local Hop Navigation
MAC addresses define the CURRENT hop:
"Right now, send this to the interface that's my next hop"
At each hop:
- Router A says: "Send to Router B at 10.0.0.2 (MAC: 3333.3333.3333)"
- Router B says: "Send to PC B at 192.168.2.100 (MAC: BBBB.BBBB.BBBB)"
Changing MAC addresses at each hop means:
- Devices know which interface to send the frame to immediately
- Each interface in a router gets its own MAC address
- The destination MAC changes based on the next hop
Analogy: Package Delivery
Package Contents:
From: 123 Main St (IP address) ← Never changes
To: 456 Oak Ave (IP address) ← Never changes
Delivery Process:
Postman A: "Take to Postal Hub B" (MAC address)
Hub B Postman: "Take to Postal Hub C" (MAC address)
Hub C Postman: "Take to 456 Oak Ave" (MAC address)
Each postman (router) has different address (MAC) for next hop
But the package's original and final addresses never change
Packet Journey with Port Numbers
Understanding Port Numbers (Layer 4)
Port numbers also remain constant throughout the journey.
Source Port: 50000 (from PC A - random ephemeral port)
Destination Port: 80 (HTTP service on PC B)
These identify the specific application/service:
- Port 80 = HTTP web server
- Port 443 = HTTPS web server
- Port 22 = SSH
- Port 23 = Telnet
- Ports 49152-65535 = Ephemeral (temporary, assigned by OS)
Why Ports Don't Change
Like IP addresses, port numbers identify the endpoint services.
If routers changed port numbers, the destination wouldn't know
which service the packet was meant for.
Routers don't care about port numbers (they're Layer 4).
Routers only care about:
- Layer 3: Destination IP (where to forward)
- Layer 2: Destination MAC (which interface to use)
TTL and the Journey
TTL Decrements at Each Router
PC A sends with TTL = 64
Router A:
Receives TTL = 64
Decrements: 64 - 1 = 63
Forwards with TTL = 63
Router B:
Receives TTL = 63
Decrements: 63 - 1 = 62
Forwards with TTL = 62
PC B:
Receives with TTL = 62
(Doesn't decrement - destination doesn't forward)
Why TTL Matters
Prevents infinite loops:
If routing loop exists (Router A → Router B → Router A):
TTL = 64 at Router A
TTL = 63 after Router B
TTL = 62 at Router A again
TTL = 61 after Router B
... continues ...
TTL = 1 at Router A
TTL = 0 after Router B → DROPPED
Packet never circulates infinitely, consuming bandwidth
Complete Packet at Each Stage
Stage 1: PC A Creates (Network A)
Ethernet Header:
├─ Dest MAC: 1111.1111.1111 (Router A G0/0)
├─ Src MAC: AAAA.AAAA.AAAA (PC A)
└─ Type: 0x0800
IPv4 Header:
├─ Src IP: 192.168.1.100
├─ Dst IP: 192.168.2.100
├─ TTL: 64
└─ Protocol: 6 (TCP)
TCP Header:
├─ Src Port: 50000
├─ Dst Port: 80
├─ Sequence: [value]
└─ Flags: [SYN]
HTTP Data: "GET / HTTP/1.1..."
Stage 2: Router A Forwards (WAN)
Ethernet Header:
├─ Dest MAC: 3333.3333.3333 (Router B G0/0) ← CHANGED
├─ Src MAC: 2222.2222.2222 (Router A G0/1) ← CHANGED
└─ Type: 0x0800
IPv4 Header:
├─ Src IP: 192.168.1.100 ← SAME
├─ Dst IP: 192.168.2.100 ← SAME
├─ TTL: 63 ← DECREMENTED
└─ Protocol: 6 (TCP) ← SAME
TCP Header: (UNCHANGED)
├─ Src Port: 50000
├─ Dst Port: 80
├─ Sequence: [value]
└─ Flags: [SYN]
HTTP Data: (UNCHANGED) "GET / HTTP/1.1..."
Stage 3: Router B Forwards (Network B)
Ethernet Header:
├─ Dest MAC: BBBB.BBBB.BBBB (PC B) ← CHANGED
├─ Src MAC: 4444.4444.4444 (Router B G0/1) ← CHANGED
└─ Type: 0x0800
IPv4 Header:
├─ Src IP: 192.168.1.100 ← SAME
├─ Dst IP: 192.168.2.100 ← SAME
├─ TTL: 62 ← DECREMENTED
└─ Protocol: 6 (TCP) ← SAME
TCP Header: (UNCHANGED)
├─ Src Port: 50000
├─ Dst Port: 80
├─ Sequence: [value]
└─ Flags: [SYN]
HTTP Data: (UNCHANGED) "GET / HTTP/1.1..."
Stage 4: PC B Receives
Ethernet Header: (Stripped off)
IPv4 Header: (Examined and passed to TCP)
├─ Src IP: 192.168.1.100 ← Identifies who sent it
├─ Dst IP: 192.168.2.100 ← "This is for me!"
├─ TTL: 62
└─ Protocol: 6 (TCP) ← "Pass to TCP handler"
TCP Header: (Examined and passed to HTTP)
├─ Src Port: 50000 ← "From where?"
├─ Dst Port: 80 ← "To HTTP service"
├─ Sequence: [value]
└─ Flags: [SYN] ← "Connection attempt"
HTTP Application: (Processes request)
"GET / HTTP/1.1 from PC A... Generate response"
Key Takeaways for CCNA
✅ IP addresses NEVER change during transit — they identify source and destination hosts
✅ MAC addresses CHANGE at every hop — they identify the current sender and next receiver
✅ Each router interface has a unique MAC address for its local network segment
✅ Routers decrement TTL by 1 at each hop to prevent infinite loops
✅ Ethernet destination MAC comes BEFORE source MAC in the header (opposite of Layer 3)
✅ Port numbers stay constant throughout the journey (identify services/applications)
✅ Routers use destination IP to determine where to forward packets
✅ Routers need destination MAC to know which interface to send the frame to
✅ If destination not directly connected, router uses next-hop IP (from routing table) to determine destination MAC
✅ Switches use destination MAC to forward frames within LANs; routers replace MAC at each hop
✅ Packet encapsulation remains as it travels — each layer's header is examined then passed down/up
✅ Return packets follow reverse path but go through same address transformations (MAC changes, IP stays same)
✅ ARP resolves IP addresses to MAC addresses when router needs to forward to next hop or final destination
✅ TTL reaching 0 causes packet to be dropped (prevents routing loop packet storms)
✅ Each device on path adds only its own MAC as source — never "hops" across multiple devices in one frame