10 The Life of a Packet

This chapter weaves together core networking ideas—switching, ARP, IPv4 addressing, and routing—by following the end-to-end journey of a single packet. Rather than introducing new topics, it consolidates prior concepts into one coherent flow, emphasizing how a host determines whether a destination is local or remote, how devices cooperate across layers, and how the IP destination remains constant while each hop rebuilds the layer-2 frame for the next segment of the path.

In the forward direction, the sender recognizes the destination is remote based on its subnet, so it targets the default gateway. It first resolves the gateway’s MAC address via ARP, while the switch learns MAC addresses, floods broadcasts and unknown unicasts, and forwards known unicasts. Each router de-encapsulates the incoming frame, performs a longest-prefix-match lookup to select the best route, ARPs for the next hop’s MAC if needed, and re-encapsulates the packet into a new frame toward that next hop. At the final router, because the destination network is directly connected, the router ARPs for the host’s MAC and delivers the packet to the endpoint, which then processes it and generates an appropriate response.

On the return trip, the process is streamlined: switches already have the necessary MAC entries and hosts/routers have ARP cache entries, so additional flooding and ARP exchanges are typically unnecessary. The reply is forwarded hop by hop using existing MAC and ARP information, with routers again relying on longest-prefix match to steer the packet back to the source. Key takeaways include the distinction between a switch’s MAC address table (MAC-to-port forwarding) and an ARP table (IP-to-MAC mapping for encapsulation), and the per-hop nature of layer-2 framing versus the end-to-end constancy of the layer-3 destination.

A summary of actions taken by each device when PC1 sends a packet to PC3. PC1 prepares a packet addressed to PC3, uses ARP to learn the default gateway’s MAC address (R1 G0/1), and sends the packet in a frame to that MAC address. The switches learn the MAC addresses of connected devices and forward/flood frames as appropriate. The routers select the best route to forward the packet, use ARP to learn the next hop’s MAC address, and forward the packet in a frame addressed to that MAC address.

PC1 uses ARP to learn R1 G0/1’s MAC. 1) PC1 sends an ARP request to 192.168.1.1. SW1 learns PC1’s MAC address, and floods the frame due to the destination MAC address of ffff.ffff.ffff. 2) After receiving the ARP request, R1 adds an ARP table entry associating IP address 192.168.1.11 with PC1’s MAC address. R1 then sends an ARP reply to PC1. SW1 learns R1 G0/1’s MAC address, and forwards the frame to PC1. 3) After receiving the ARP reply, PC1 adds an ARP table entry associating IP address 192.168.1.1 with R1 G0/1’s MAC address.

R1 receives PC1’s message, performs a routing table lookup, and uses ARP to learn the MAC address of the next hop. 1) R1 receives the frame/packet and performs a routing table lookup. The most specific matching route is to 192.168.3.0/24, next hop 192.168.12.2. 2) R1 uses ARP to learn the MAC address of 192.168.12.2 (R2 G0/0). R1 and R2 both add entries to their ARP tables. R1 is now ready to forward the packet to the next hop.

R2 receives the frame from R1, performs a routing table lookup, and uses ARP to learn the MAC address of the next hop. 1) R2 receives the frame/packet and performs a routing table lookup. The most specific matching route is to 192.168.3.0/24, next hop 192.168.23.2. 2) R2 uses ARP to learn the MAC address of 192.168.23.2 (R3 G0/0). R2 and R3 both add entries to their ARP tables. R2 is now ready to forward the packet to the next hop.

R3 receives the frame from R2, performs a routing table lookup, and uses ARP to learn the MAC address of the next hop. 1) R3 receives the frame/packet and performs a routing table lookup. The most specific matching route is the connected route to 192.168.3.0/24. 2) R3 uses ARP to learn the MAC address of 192.168.3.11 (PC3). SW2 learns the MAC addresses of R3 G0/1 and PC3. R3 and PC3 both add entries to their ARP tables. R3 is now ready to forward the packet to the destination.

PC3 sends a reply to PC1. 1) PC3 sends the packet in a frame addressed to the default gateway (R3 G0/1). 2) SW2 forwards the frame. 3) R3 performs a routing table lookup and forwards the packet in a frame to R2 G0/1. 4) R2 performs a routing table lookup and forwards the packet in a frame to R1 G0/0. 5) R1 performs a routing table lookup and forwards the packet in a frame to the destination (PC1). 6) SW1 forwards the frame.

• To send packets to remote destinations, an end host (such as a PC) will send the packet to its default gateway (router). To do so, it will encapsulate the packet in a frame addressed to the default gateway’s MAC address. To learn the default gateway’s MAC address, it will use ARP.
• ARP involves two messages: ARP request (broadcast) and ARP reply (unicast).
• When a device receives an ARP request, it doesn’t just send an ARP reply; it also makes an entry in its own ARP table, mapping the IP address of the host that sent the request to that host’s MAC address.
• Switches learn MAC addresses, and forward or flood frames as appropriate. They do not modify the frames they forward; their operations are transparent to the devices connected to them.
• A switch will flood broadcast and unknown unicast frames. It will forward known unicast frames.
• When a router receives a frame addressed to its own MAC address, it will de-encapsulate it and examine the packet inside. It then performs a routing table lookup to determine how to forward the packet (or drop the packet, or receive the packet for itself).
• A router will forward a packet according to the most specific matching route: the matching route with the longest prefix length.
• To forward a packet to the next hop in the path, a router will forward the packet in a frame addressed to the next hop’s MAC address. To learn the next hop’s MAC address, it will use ARP.
• To forward a packet to the packet’s destination host, a router will forward the packet in a frame addressed to the destination host’s MAC address, using ARP to learn the MAC address.

FAQ