Day 12: Life of a Packet

CCNA 200-301 Study Guide: The Life of a Packet

Introduction:Overview

Mastering

What is the Fundamental"Life Journeyof a Packet"?

The life of a packet traces the complete journey of ana IPsingle packet isas theit cornerstonetravels offrom source to destination across multiple networks, through switches and routers, with different headers being applied and modified at each stage.

Core Principle:

A packet passes through many network engineering.devices Itand weavesmay throughtraverse multiple high-valuenetworks. examAs domains,it including Network Fundamentals, Network Access, and IP Connectivity. Understanding how routers and switches interact to move data is essential for both the CCNA exam and real-world troubleshooting.travels:

1.0 Strategic Overview of the CCNA 200-301 (v1.1) Exam

The CCNA 200-301 is a 120-minute assessment covering six major domains. A rock-solid understanding of the first three domains (totaling 71% of the exam) is the key to passing.

Exam Domain Breakdown

2.0 The Core Principles of Data Transmission

The "Golden Rules" govern every Layer 3 packet movement across a network.

The Two Golden Rules

1. • IP Addressesaddresses Remain(Layer Constant:3) TheNEVER Sourcechange — they identify the source and Destinationdestination IP addresses in the packet header are end-to-end identifiers. They do not change as the packet moves through routers (unless NAT is applied).hosts

   • MAC Addressesaddresses Change(Layer 2) CHANGE at Eachevery Hop:hop — they identify the current sender and next receiver

This distinction is critical for understanding how networks actually work.

 

---

 

The Big Picture: Layer 3 vs Layer 2

IP Addresses (Layer 3) — End-to-End

IP addresses remain CONSTANT throughout the packet's journey.

SOURCE IP: 192.168.1.100

DESTINATION IP: 192.168.2.100

These never change, no matter how many routers the packet passes through.

They identify the ultimate SOURCE and DESTINATION hosts.

Purpose: Tell routers where the packet needs to go (the final destination)

Used by: Routers to make forwarding decisions

MAC Addresses (Layer 2) — Hop-by-Hop

MAC addresses areCHANGE local,at next-every hop delivery— instructions.new Everysource routerand alongdestination at each step.

Each interface on a network device (router, switch) has its OWN MAC address.

As a packet travels, different interfaces add their own MAC addresses.

Hop 1: Source MAC = PC's NIC, Destination MAC = Router's G0/0 interface

Hop 2: Source MAC = Router's G0/1 interface, Destination MAC = Next Router's interface

Hop 3: Source MAC = Next Router's interface, Destination MAC = Destination host's NIC

Purpose: Tell the pathnext rewritesdevice where to send the frame (the immediate next hop)

Used by: Switches to forward within LANs, routers to forward between LANs

Why This Matters

Analogy: Sending a letter through the mail

IP Address = Your home address + recipient's home address

  (Written on the envelope, never changes)

  

MAC Address = Current postal worker + Next postal facility

  (Changes at each facility — each worker adds/removes their stamp)

 

---

 

Packet Structure Review

Layers of Encapsulation

┌─────────────────────────────────────┐

│      Application Data (HTTP, etc)   │

├─────────────────────────────────────┤

│  TCP/UDP Header (Source Port,       │

│  Destination Port, Sequence, etc)   │ ← Layer 4 PDU

├─────────────────────────────────────┤

│  IPv4 Header (Source IP,            │

│  Destination IP, TTL, Protocol)     │ ← Layer 3 PDU / IP Packet

├─────────────────────────────────────┤

│  Ethernet Header (Dest MAC,         │

│  Source MAC, Type)                  │ ← Layer 2 framePDU header./ Ethernet Frame

│ 

 Ethernet Trailer (FCS)             │

└─────────────────────────────────────┘

DeviceField RolesOrder Matters!

Critical observation: The fields appear in a specific order

In TCP Header:

[Source IP] [Destination IP] [Source Port] [Destination Port]

  ↑            ↑

  Source comes FIRST

In Ethernet Header:

[Destination MAC] [Source MAC] [Type]

   ↑                ↑

   Destination comes FIRST (opposite of Layer 3!)

This is important because it shows the different perspectives:

• Switches (Layer 2):3 Forward frames within a single segment basedfocuses on the MACultimate Addressdestination Table.(where Theyare dowe not inspect or modify the IP packet inside the frame.going?)

• Routers (Layer 3):2 Actfocuses as gatekeepers between networks. They de-encapsulateon the frame, inspect the Destination IP, decrement the TTL, and re-encapsulate the packet into a new frame for theimmediate next hop.hop (who am I sending to right now?)

 

---

 

3.0Detailed ARP:Journey: ThePacket BridgeTravels BetweenThrough Layer 3 and Layer 2Network

Scenario Setup

The                   Address[Router ResolutionB]

Protocol

                   (ARP)10.0.0.2

resolves

                        a|

known

                   LayerWAN 3Link

                        |

PC A ─[Switch]─ [Router A] ─────────── [Switch] ─── PC B

192.168.1.100    10.0.0.1                          192.168.2.100

                                                      10.0.0.2

Network A:

- PC A: IP address192.168.1.100, MAC AAAA.AAAA.AAAA

- Router A G0/0: IP 192.168.1.1, MAC 1111.1111.1111

- Router A G0/1: IP 10.0.0.1, MAC 2222.2222.2222

WAN Link:

- Router B G0/0: IP 10.0.0.2, MAC 3333.3333.3333

Network B:

- Router B G0/1: IP 192.168.2.1, MAC 4444.4444.4444

- PC B: IP 192.168.2.100, MAC BBBB.BBBB.BBBB

Task: PC A sends HTTP packet to PC B

 

---

 

Step-by-Step Packet Journey

Step 1: PC A Creates the Packet

PC A (192.168.1.100) initiates an unknownHTTP Layerrequest 2to PC B (192.168.2.100)

First, PC A checks if 192.168.2.100 is on the same network:

PC A's IP: 192.168.1.100/24

Network: 192.168.1.0/24 (host 100 is in this network)

Destination: 192.168.2.100/24

Network: 192.168.2.0/24 (different network!)

Conclusion: 192.168.2.100 is NOT on my local network

Action: Send to default gateway (router)

PC A needs Router A's MAC address.address (192.168.1.1)

ARP Request:PC A broadcastsends (FFFF.FFFF.FFFF)ARP askingREQUEST:

  "Who has IP192.168.1.1? X.X.X.X?"Tell 192.168.1.100"

  

ARP Reply:Router A unicastresponds messagewith fromARP REPLY:

  "I have 192.168.1.1. My MAC is 1111.1111.1111"

  

PC A learns: Router A's MAC = 1111.1111.1111

PC A creates the target device providing its MAC address.packet:

┌─────────────────────────────────────────┐

ARP│ Cache:Application Data (HTTP Request)         │

├─────────────────────────────────────────┤

│ TCP Header                              │

│ Source Port: 50000                      │

│ Destination Port: 80                    │

├─────────────────────────────────────────┤

│ IPv4 Header                             │

│ Source IP: 192.168.1.100        ← CONSTANT

│ Destination IP: 192.168.2.100   ← CONSTANT

│ TTL: 64                         ← Will decrement

├─────────────────────────────────────────┤

│ Ethernet Header                         │

│ Destination MAC: 1111.1111.1111 ← Router A

local

│ tableSource whereMAC: mappingsAAAA.AAAA.AAAA      ← PC A

│ Type: 0x0800 (IPv4)             │

├─────────────────────────────────────────┤

│ Ethernet Trailer (FCS)                  │

└─────────────────────────────────────────┘

Key Point: IP addresses are storedalready temporarilyset to— reducethey broadcastwill traffic.NOT change during transit!

 

4.0 A Packet's Journey: A Four-Hop Walkthrough

---

Scenario: PC1 (192.168.1.1) sends a packet to PC4 (192.168.4.1).

Step 1:2: ThePacket SourceTravels on Network A (PC1Local LAN)

PC A sends the frame out on the Ethernet to R1)all

devices on the switch

Logic:Switch PC1processing:

sees

Switch thatreceives PC4frame on port with PC A

  ↓

Examines Destination MAC: 1111.1111.1111

  ↓

Looks in MAC address table: "Where is 1111.1111.1111?"

  ↓

MAC table shows: 1111.1111.1111 is on aport differentconnected subnet.to ItRouter mustA

send

  ↓

Action: Forward frame out that port only (known unicast)

Router A receives the packetframe toon itsinterface Default Gateway (R1).G0/0

Router

A receives frame on G0/0

Frame  1:↓

Examines

Ethernet Destination MAC: 1111.1111.1111

  ↓

Checks local interfaces: "Is this MY MAC? Yes!"

  ↓

Action: Strip Ethernet header/trailer, examine IPv4 header

 

---

 

Step 3: Router A Processes the Packet

Router A examines the IPv4 header:

Source IP: 192.168.1.1100

| Dest

Destination IP: 192.168.4.12.100

TTL:

64

Router A's routing table lookup:

  "Destination 192.168.2.100... which network? 192.168.2.0/24"

  "Where is 192.168.2.0/24? Via next-hop 10.0.0.2"

  "That's Router B at 10.0.0.2"

  

Action: Forward out interface G0/1 toward Router B

Router A decrements TTL:

Original TTL: 64

Decremented: 64 - 1 = 63

New TTL: 63

Router A creates NEW Ethernet header:

This is CRITICAL: The Ethernet header is REPLACED!

Old Ethernet Header (from Network A):

  Destination MAC: 1111.1111.1111 (Router A's G0/0)

  Source MAC: PC1_MACAAAA.AAAA.AAAA |(PC DestA's NIC)

New Ethernet Header (for WAN Link):

  Destination MAC: R1_g0/0_MAC3333.3333.3333 ← Router B's G0/0

  

Source MAC: 2222.2222.2222     ← Router A's G0/1

  Type: 0x0800 (IPv4)

IPv4 Header (UNCHANGED):

  Source IP: 192.168.1.100        ← STILL THE SAME

  Destination IP: 192.168.2.100   ← STILL THE SAME

  TTL: 63                         ← Decremented

Visualization of what happened:

Before Router A processing:

┌─────────────────────────┐

│ Application Data (HTTP) │

├─────────────────────────┤

│ TCP Header              │

├─────────────────────────┤

│ IPv4 Header             │

│ Src: 192.168.1.100      │

│ Dst: 192.168.2.100      │

│ TTL: 64                 │

├─────────────────────────┤

│ Eth Header (OLD)        │

│ Dst MAC: 1111.1111.1111 │

│ Src MAC: AAAA.AAAA.AAAA │

└─────────────────────────┘

After Router A processing:

┌─────────────────────────┐

│ Application Data (HTTP) │

├─────────────────────────┤

│ TCP Header              │

├─────────────────────────┤

│ IPv4 Header             │

│ Src: 192.168.1.100 ✓    │

│ Dst: 192.168.2.100 ✓    │

│ TTL: 63                 │

├─────────────────────────┤

│ Eth Header (NEW)        │

│ Dst MAC: 3333.3333.3333 │

│ Src MAC: 2222.2222.2222 │

└─────────────────────────┘

 

---

 

Step 2:4: ThePacket FirstTravels Hopon (R1WAN to R2)Link

Router

A sends the new frame toward Router B

Logic:Router R1B receives the frame,frame stripson interface G0/0

Router B receives frame on G0/0

  ↓

Examines Ethernet Destination MAC: 3333.3333.3333

  ↓

Checks local interfaces: "Is this MY MAC? Yes!"

  ↓

Action: Strip Ethernet header/trailer, examine IPv4 header

 

---

 

Step 5: Router B Processes the L2Packet

header,

Router andB looks up 192.168.4.1 in its routing table. It findsexamines the nextIPv4 hop is R2.header:

Frame 2:

Source IP: 192.168.1.1100 |       Dest← Still PC A!

Destination IP: 192.168.4.2.100   ← Still PC B!

TTL: 63

Router B's routing table lookup:

  "Destination 192.168.2.100... which network? 192.168.2.0/24"

  "Is 192.168.2.0/24 directly connected to me? Yes! On G0/1"

  

Action: Forward directly out interface G0/1

Router B decrements TTL:

Original TTL: 63

Decremented: 63 - 1 = 62

New TTL: 62

Router B creates NEW Ethernet header:

This time, destination is directly connected:

Old Ethernet Header (from WAN):

  Destination MAC: 3333.3333.3333 (Router B's G0/0)

  Source MAC: R1_s0/0_MAC2222.2222.2222 |(Router DestA's G0/1)

Router B needs PC B's MAC address:

  Sends ARP REQUEST: "Who has 192.168.2.100? Tell me"

  PC B responds: "I have 192.168.2.100. My MAC is BBBB.BBBB.BBBB"

  Router B learns: PC B's MAC = BBBB.BBBB.BBBB

New Ethernet Header (for Network B):

  Destination MAC: R2_s0/0_MACBBBB.BBBB.BBBB ← PC B's NIC

  

Source MAC: 4444.4444.4444     ← Router B's G0/1

  Type: 0x0800 (IPv4)

IPv4 Header (UNCHANGED):

  Source IP: 192.168.1.100        ← STILL THE SAME

  Destination IP: 192.168.2.100   ← STILL THE SAME

  TTL: 62                         ← Decremented again

 

---

 

Step 3:6: ThePacket IntermediateTravels Hopon Network B (R2Local LAN)

Router B sends the frame out on the Ethernet to R4)switch

on Network B

Logic:Switch R2processes:

de-encapsulates,

Switch decrementsreceives TTL,frame andon findsport with Router B

  ↓

Examines Destination MAC: BBBB.BBBB.BBBB

  ↓

Looks in MAC address table: "Where is BBBB.BBBB.BBBB?"

  ↓

MAC table shows: BBBB.BBBB.BBBB is on port connected to PC B

  ↓

Action: Forward frame out that port only

PC B receives the pathframe

to

PC B's NIC receives frame

  ↓

Examines Ethernet Destination MAC: BBBB.BBBB.BBBB

  ↓

Checks: "Is this MY MAC? Yes!"

  ↓

Action: Accept frame, strip Ethernet header/trailer

  ↓

Examine IPv4 header

 

---

 

Step 7: PC B Processes the 192.168.4.0/24 network via R4.

Packet

FramePC 3:B examines the IPv4 header:

Source IP: 192.168.1.1100 |       Dest← Where did this come from

Destination IP: 192.168.4.12.100   ← This is MY IP

TTL:

62

Router processing: "Is this packet destined for ME? Yes!"

Action: Don't forward, hand to Layer 4 (TCP)

PC B examines the TCP header:

Source Port: 50000 (from PC A)

Destination Port: 80 (HTTP)

TCP processing: "Is port 80 open? Yes, web server is listening"

Action: Pass to HTTP application (web browser or server)

PC B's HTTP application receives the data

Application layer processes the HTTP request

Web server generates HTTP response

Response is sent back toward PC A (reverse journey)

 

---

 

Summary: MAC Addresses vs IP Addresses

What Changed / What Stayed the Same

                PC A            Router A        Router B          PC B

                  ↓                 ↓               ↓                ↓

Ethernet Header:

Dest MAC    AAAA→1111        AAAA→3333       3333→BBBB

Src MAC     AAAA←AAAA        2222←2222       4444←4444

                ↓↓              ↓↓              ↓↓

              CHANGED          CHANGED        CHANGED at each hop

IPv4 Header:

Src IP      192.168.1.100 → 192.168.1.100 → 192.168.1.100 → 192.168.1.100

            ↓↓                                                 

            NEVER CHANGES - Identifies ultimate source

Dst IP      192.168.2.100 → 192.168.2.100 → 192.168.2.100 → 192.168.2.100

            ↓↓

            NEVER CHANGES - Identifies ultimate destination

TTL         64 → 63 → 62 → 61

            ↓↓  ↓↓

            DECREMENTED at each router hop

 

---

 

Key Concepts: Why MAC Changes, IP Doesn't

IP Addresses: End-to-End Navigation

IP addresses define the final destination:

"I am PC A (192.168.1.100) and I want to send this to PC B (192.168.2.100)"

This information MUST be in every packet so that:

1. Routers know the ultimate destination

2. The destination knows it was for them

3. Response packets can find the way back

Changing IP addresses would mean:

- Routers wouldn't know where to send it

- Destination wouldn't know who to respond to

MAC Addresses: Local Hop Navigation

MAC addresses define the CURRENT hop:

"Right now, send this to the interface that's my next hop"

At each hop:

- Router A says: "Send to Router B at 10.0.0.2 (MAC: R2_s0/1_MAC3333.3333.3333)"

|

- Router B says: "Send to PC B at 192.168.2.100 (MAC: BBBB.BBBB.BBBB)"

Changing MAC addresses at each hop means:

- Devices know which interface to send the frame to immediately

- Each interface in a router gets its own MAC address

- The destination MAC changes based on the next hop

Analogy: Package Delivery

Package Contents: 

  From: 123 Main St (IP address) ← Never changes

  To: 456 Oak Ave (IP address) ← Never changes

Delivery Process:

  Postman A: "Take to Postal Hub B" (MAC address)

  Hub B Postman: "Take to Postal Hub C" (MAC address)

  Hub C Postman: "Take to 456 Oak Ave" (MAC address)

  

Each postman (router) has different address (MAC) for next hop

But the package's original and final addresses never change

 

---

 

Packet Journey with Port Numbers

Understanding Port Numbers (Layer 4)

Port numbers also remain constant throughout the journey.

Source Port: 50000 (from PC A - random ephemeral port)

Destination Port: 80 (HTTP service on PC B)

These identify the specific application/service:

- Port 80 = HTTP web server

- Port 443 = HTTPS web server  

- Port 22 = SSH

- Port 23 = Telnet

- Ports 49152-65535 = Ephemeral (temporary, assigned by OS)

Why Ports Don't Change

Like IP addresses, port numbers identify the endpoint services.

If routers changed port numbers, the destination wouldn't know

which service the packet was meant for.

Routers don't care about port numbers (they're Layer 4).

Routers only care about:

- Layer 3: Destination IP (where to forward)

- Layer 2: Destination MAC (which interface to use)

 

---

 

TTL and the Journey

TTL Decrements at Each Router

PC A sends with TTL = 64

Router A:

  Receives TTL = 64

  Decrements: 64 - 1 = 63

  Forwards with TTL = 63

Router B:

  Receives TTL = 63

  Decrements: 63 - 1 = 62

  Forwards with TTL = 62

PC B:

  Receives with TTL = 62

  (Doesn't decrement - destination doesn't forward)

Why TTL Matters

Prevents infinite loops:

If routing loop exists (Router A → Router B → Router A):

  TTL = 64 at Router A

  TTL = 63 after Router B  

  TTL = 62 at Router A again

  TTL = 61 after Router B

  ... continues ...

  TTL = 1 at Router A

  TTL = 0 after Router B → DROPPED

Packet never circulates infinitely, consuming bandwidth

 

---

 

Complete Packet at Each Stage

Stage 1: PC A Creates (Network A)

Ethernet Header:

├─ Dest MAC: R4_s0/1_MAC1111.1111.1111 (Router A G0/0)

├─

Src MAC:

Step 4: The Final DeliveryAAAA.AAAA.AAAA (R4PC to PC4)

A)

Logic:└─ R4Type: sees that 192.168.4.0/24 is a directly connected network. It ARPs for PC4's MAC.0x0800

FrameIPv4 4:Header:

├─

SourceSrc IP: 192.168.1.1100

|

├─ DestDst IP: 192.168.4.12.100

├─

TTL: 64

Source└─ MAC:Protocol: R4_g0/1_MAC6 |(TCP)

TCP Header:

├─ Src Port: 50000

├─ Dst Port: 80

├─ Sequence: [value]

└─ Flags: [SYN]

HTTP Data: "GET / HTTP/1.1..."

Stage 2: Router A Forwards (WAN)

Ethernet Header:

├─ Dest MAC: PC4_MAC3333.3333.3333 (Router B G0/0) ← CHANGED

├─

Src MAC:

5.02222.2222.2222 Verification(Router A G0/1) ← CHANGED

└─ Type: 0x0800

IPv4 Header:

├─ Src IP: 192.168.1.100 ← SAME

├─ Dst IP: 192.168.2.100 ← SAME

├─ TTL: 63 ← DECREMENTED

└─ Protocol: 6 (TCP) ← SAME

TCP Header: (UNCHANGED)

├─ Src Port: 50000

├─ Dst Port: 80

├─ Sequence: [value]

└─ Flags: [SYN]

HTTP Data: (UNCHANGED) "GET / HTTP/1.1..."

Stage 3: Router B Forwards (Network B)

Ethernet Header:

├─ Dest MAC: BBBB.BBBB.BBBB (PC B) ← CHANGED

├─ Src MAC: 4444.4444.4444 (Router B G0/1) ← CHANGED

└─ Type: 0x0800

IPv4 Header:

├─ Src IP: 192.168.1.100 ← SAME

├─ Dst IP: 192.168.2.100 ← SAME

├─ TTL: 62 ← DECREMENTED

└─ Protocol: 6 (TCP) ← SAME

TCP Header: (UNCHANGED)

├─ Src Port: 50000

├─ Dst Port: 80

├─ Sequence: [value]

└─ Flags: [SYN]

HTTP Data: (UNCHANGED) "GET / HTTP/1.1..."

Stage 4: PC B Receives

Ethernet Header: (Stripped off)

IPv4 Header: (Examined and Diagnosticpassed Commandsto TCP)

├─ Src IP: 192.168.1.100 ← Identifies who sent it

├─ Dst IP: 192.168.2.100 ← "This is for me!"

├─ TTL: 62

└─ Protocol: 6 (TCP) ← "Pass to TCP handler"

TCP Header: (Examined and passed to HTTP)

├─ Src Port: 50000 ← "From where?"

├─ Dst Port: 80 ← "To HTTP service"

├─ Sequence: [value]

└─ Flags: [SYN] ← "Connection attempt"

HTTP Application: (Processes request)

"GET / HTTP/1.1 from PC A... Generate response"

 

---

 

Key Takeaways for CCNA

Host Commands (Windows/Linux)

Cisco IOS Commands

6.0 Conclusion: Key Takeaways

IP Addresses are for end-to-end delivery.

MAC Addresses are for hop-to-hop delivery.

Routers strip and rebuild Layer 2 framesCHANGE at every hop.hop — they identify the current sender and next receiver

✅

Each router interface has a unique MAC address for its local network segment

ARP✅ Routers decrement TTL by 1 at each hop to prevent infinite loops

✅ Ethernet destination MAC comes BEFORE source MAC in the header (opposite of Layer 3)

✅ Port numbers stay constant throughout the journey (identify services/applications)

✅ Routers use destination IP to determine where to forward packets

✅ Routers need destination MAC to know which interface to send the frame to

✅ If destination not directly connected, router uses next-hop IP (from routing table) to determine destination MAC

✅ Switches use destination MAC to forward frames within LANs; routers replace MAC at each hop

✅ Packet encapsulation remains as it travels — each layer's header is theexamined essentialthen gluepassed thatdown/up

allows

✅ aReturn packets follow reverse path but go through same address transformations (MAC changes, IP stays same)

✅ ARP resolves IP addresses to MAC addresses when router needs to forward to next hop or final destination

✅ TTL reaching 0 causes packet to be dropped (prevents routing loop packet storms)

✅ Each device toon buildpath a frame when itadds only knowsits anown IPMAC address.as source — never "hops" across multiple devices in one frame