ccnahub.com http://www.ccnahub.com/ip-fundamentals/understanding-packet-flow-across-the-network/

Understanding Packet Flow Across the Network

Understanding Packet Flow Across the Network Article covers the following CCNA and ICND1 v2 Exam Topics:

Under Operation of IP Data Networks:

1. Predict the data flow between two hosts across a network.

2. Select the components required to meet a given network specification.

3. Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges, and Hubs.

Under IP Routing Technologies:

1. Differentiate methods of routing and routing protocols such Static vs. Dynamic.

Recommended Study Plan:

1. Download the ICND1v2 Exam Topics Sheet from Cisco Website.

2. Follow the Steps and the Articles under “ IP Networks Fundamentals” by order.

3. Or Start with TCP/IP and OSI Models Article.

Average Time Required Studying this Article: 1 Hour

TCP/IP Way of Encapsulation: Data, Segments, Packets, and Frames

It started with PC1 requesting www.ccnahub.com homepage from a Web-Server.

PC1′s TCP/IP Stack Application Layer encapsulated the HTTP Data Request into HTTP Data Header, and handledthe Header to the Transport Layer for further Processing (1). Transport Layer encapsulated the HTTP Data Headerinto Segment (s) adding source and destination TCP ports to the Segment (s), and handled the Segments to NetworkLayer for Packing using Logical Addressing (2). Network Layer encapsulated the Segment (s) into an IP Packet(s) adding logical source and destination IP addresses to the packet (s), and handled the packet (s) to the Data LinkLayer for Framing using Hardware Addressing (3), Data Link Layer encapsulated the IP Packet (s) into a Frame(s) adding hardware source and destination MAC addresses to the Frame (s) with Ethernet Header and Trailer, andhandled the Frame (s) to the Physical Layer for Delivery using Ethernet Standard or Protocol(4), PhysicalLayer converted the Frame (s) one at a time to stream of bits, encoded the bits into signals based on the type ofmedia used (Copper, Fiber, or Wireless), and transmitted the signals one at a time to the Default Gateway (5).

How PC1 Route Packets and Forward Frames to the Default Router?

In the above figure, PC1 requested a ccnahub.com homepage from the Web-server, and while requesting, it doessome analysis and figure out that the IP of ccnahub.com is located in different subnet, hence, PC1 chooses to sendthe IP packet (s) to the nearby router (R3), once received by R3, it will forward the packet (s) again to nearby Routertill the packet (s) reach final destination. PC1’s TCP/IP Stack analyzes decided that the destination IP address ofccnahub.com is located at web-server (172.16.10.20) which is not on the same LAN where PC1 resides. So PC1’sTCP/IP logic decided to route the HTTP Request packet (s) to a nearby default gateway (R3) which is located on thesame LAN as PC1.

To send packet (s) to the default gateway router, PC1 forwards frame (s) that hold the packet (s) across the ethernetmedium to (R3); these frames include the packets in the data portion of the Ethernet frames. From PC1 perspective,the frames addressed to R3 as next-hop using R3′s MAC address.

To distinguish, notice the difference between IP Routing and MAC forwarding Concept:

Two main Concepts:

Network Layer Routing Concept: is based on Dotted Decimal Notation Logical destination IP Address inside the IPPacket (172.16.10.20). Meaning, Internet Protocol (IP) Routes IP packets using IP Address System across theinternet without really caring or bothering what LAN medium or WAN connection in use (Either Ethernet, PPP, HDLC,Frame Relay, ATM, Fiber, Etc…), therefore, Internet Protocol (IP) Route IP Packets .

Data-Link Layer Forwarding Concept: is based on 12-Hex Character Physical destination MAC Address inside theframe (3001.2222.2222). Meaning, Ethernet Physical Address is used as a vehicle to transport the Packet (s), hence,different MAC address is used on each Hop (that is: different vehicle) till the IP Packet (s) reach its final destination. InEthernet Networks: Each Hop represents its own vehicle (MAC address). Therefore, Ethernet Protocol and WANProtocols (HDLC, PPP, Frame Relay), all of them Froward Frames to be processed with the Next-Hop till the Packet’sdestination IP Address hit its Network as the final destination.

Keep in mind that Ethernet MAC addresses are ONLY and ONLY associated with Ethernet Protocol, and whenit comes to WAN Protocols such, HDLC, PPP, Frame Relay, etc… If PPP, HDLC, or Frame Relay is used forWAN connection, Data-Link Layer DOES NOT encapsulate IP Packets into Frames using Ethernet MACaddresses, each one of these WAN Protocols such HDLC, PPP, or Frame Relay has it’s own hardware Addressto use that is different than Ethernet MAC Address System. BUT there is one exception though: if EthernetWAN Technology used, which called Ethernet over Multiprotocol Label Switching (EoMPLS) between 2Routers, then MAC addresses can be used to move IP Packets between the Only 2 Routers that areconnected With EoMPLS.

We are going to map each step to the upper Large Figure, so I recommend to print or open it in different Window toMAP each step. All the routers in these detailed steps are using OSPFv2 Routing protocol already configured withroutes and subnets. The steps demonstrates how TCP/IP Layers work together to deliver the data using IP Packetsand Data Link Frames.

Step 1 – PC1′s Downstream: started with PC1’s browser requesting www.ccnahub.com homepage.

Application Layer – Downstream: Creates and encapsulates the application requests or data with any requiredApplication Layer headers, and handle it the Transport Layer for segmentation.

That is: PC1’s Application layer creates and encapsulates HTTP (GET message) request inside a HTTP header.

Transport Layer – Downstream: Receives and encapsulates the data supplied by the Application Layer inside aTCP or UDP header forming a Segment, adds destination and source TCP or UDP port to the segment, and finally

handle the segment to the Network layer for packing procedure.

That is: PC1’s Transport Layer receives and encapsulates the data supplied by PC1’s Application Layer inside TCPheader forming a segment (1), adds a destination TCP port (80) as http service receiver (2), adds a dynamic sourceport (5480) as App (web-browser) sender (3), and finally handles the segment to the Network Layer for packingprocedure (4).

Network Layer - Downstream: Receives and encapsulates the TCP or UDP header supplied by the Transport layerinside an IP Header forming an IP Packet, translates the destination domain name http://www.ccnahub.com to IPaddress using DNS, adds a destination and source IP addresses to the IP packet, and finally routes the IP packetusing outgoing NIC or interface through the Data Link Layer.

That is: PC1’s Network Layer receives and encapsulates the TCP segment inside an IP header forming an IP Packet(1), adds a destination IP address of ccnahub.com (172.16.10.20) as final destination (2), adds PC1′s source IPaddress (192.168.1.100) as sender (3), and finally routes the IP packet using PC1’s NIC as outgoing interfacethrough the Data-Link layer to default gateway (R3) (4).

Data Link Layer – Downstream using Ethernet LAN NIC: Receives the IP Packet from the Network Layer andencapsulates the IP Packet inside an Ethernet Header and Trailer to forming a Frame, Ethernet is used, addsdestination and source MAC addresses to the Frame based on Address Resolution Protocol (ARP) table, and finallyforwards the Frame to the next-hop using the device’s outgoing NIC or interface through the physical layer.

That is: PC1’s Data-Link Layer receives and encapsulates the IP packet inside an Ethernet Header and Trailerforming a frame (1), adds a destination MAC address of R3’s f0/1 LAN interface (3001.2222.2222) as next-hop (2),adds the PC1’s NIC source MAC address (3001.3333.3333) as sender (3), and forwards the frame using PC1’s NICas outgoing interface through the Physical layer to R3′s f0/1 (4).

Physical Layer – Downstream: Receives and converts the frame to bits, encodes the bits into signals based on thetype of media used (Copper, Fiber, or Wireless), and transmits the signals one at a time using the device’s outgoingNIC or interface through the media used.

That is: PC1’s Physical Layer receives and converts the frame to bits (1), since Ethernet Copper cable is used,encodes the bits into electrical signals (2), and finally transmits the electrical signals one at a time using PC1’soutgoing NIC interface, through the physical cable heading to R3 (3).

Step 2 – R3′s Upstream using Ethernet LAN Port:

Physical Layer: Receives the signals from PC1’s Physical layer through R3’s f0/1 interface and de-encode eachelectrical signal as bit stream (1), reassemble each bit stream as frame (2), and handles each frame to the Data-LinkLayer (3).

Data-link Layer: Receives the frames from the physical layer and applies Frame Check Sequence (FCS) on eachframe for any error (1), if no errors found, it de-encapsulates each frame contents (2), strips (discards) any MACaddresses with it’s Header and Trailer (3), and Handles ONLY the IP packet to the Network Layer (4).

Network Layer: Receives and reads the IP Packet’s destination and source IP addresses (1), compares destinationIP (172.16.10.20) to known IP routes or subnets by reading the Routing Table Entries to analyze 172.16.10.20’ssubnet – Bingo! 172.16.10.0/24 Subnet found, which includes addresses 172.16.10.1 through 172.16.10.254 (3),Now the Routing decision: the subnet’s route states: 172.16.10.0 via 10.50.20.2 using f0/0 interface as outgoinginterface (4), and routes the IP packet using f0/0 interface as outgoing interface through the Data-link Layer (5).

Note: 172.16.10.0 via 10.50.20.2 using f0/0 >>> 10.50.20.2 is R2’s IP address which is next router, and f0/0belongs to R3 as outgoing interface.

Data-link Layer – R3′s Downstream using Ethernet WAN Port: Receives the IP Packet back from the NetworkLayer and encapsulates it inside a NEW Ethernet Header and Trailer forming a NEW Frame (1), adds new destinationMAC address of R2’s f0/0 (2001.2222.2222) as next-hop based on ARP cache table (2), adds new source MACaddress of R3’s f0/0 (3001.1111.1111) interface as a sender (3), and forwards the NEW Frame using R3’s f0/0 asoutgoing interface through the Physical layer.

Physical Layer: Physical Layer receives the New Frame from the Data link layer and converts it to bits (1), sinceserial copper cable is used, encodes the bits into electrical signals (2), and transmits the electrical signals one at atime using R3’s f0/0 outgoing interface, through the EoMPLS link heading to R2 (3).

Step 3 – R2′s Upstream using Ethernet WAN Port:

Physical Layer: Receives the signals from R3’s Physical layer through R2’s f0/0 interface and de-encode eachelectrical signal as bit stream (1), reassemble each bit stream as frame (2), and handles each frame to the Data-LinkLayer (3).

Data-link Layer: Receives the frames from the physical layer and applies Frame Check Sequence (FCS) on eachframe for any error (1), if no errors found, it de-encapsulates each frame contents (2), strips (discards) any MACaddresses with it’s Header and Trailer (3), and Handles ONLY the IP packet to the Network Layer (4).

Network Layer: Receives and reads the IP Packet’s destination and source IP addresses (1), compares destinationIP (172.16.10.20) to known IP routes or subnets by reading the Routing Table Entries to analyze 172.16.10.20’ssubnet – Bingo! 172.16.10.0/24 Subnet found, which includes addresses 172.16.10.1 through 172.16.10.254 (3),Now the Routing decision: the subnet’s route states: 172.16.10.0 via 10.50.10.2 using s0/0 interface as outgoinginterface (4), and routes the IP packet using s0/0 interface as outgoing interface through the Data-link Layer (5).

Note: 172.16.10.0 via 10.50.10.2 using s0/0 >>> (10.50.10.2 is R1’s IP address which is the next router, and s0/0belongs to R2 as outgoing interface.

Data-link Layer – R2′s Downstream using PPP Leased Line Serial Port: Receives the IP Packet back from theNetwork Layer and encapsulates it inside a NEW PPP or HDLC Header and Trailer forming a NEW Frame (1), andforwards the NEW Frame using R2’s s0/0 as outgoing interface through the Physical layer (2).

Physical Layer: Physical Layer receives the New Frame from Data link layer and converts it to bits (1), sinceEthernet copper cable is used, encodes the bits into electrical signals (2), and transmits the electrical signals one at atime using R2’s s0/0 outgoing interface, through the EoMPLS link heading to R1 (3).

Step 4 - R1′s Upstream using PPP Leased Line Serial Port:

Physical Layer: Receives the signals from R2’s Physical layer through R1’s s0/0 interface and de-encode eachelectrical signal as bit stream (1), reassemble each bit stream as frame (2), and handles each frame to the Data-LinkLayer (3).

Data-link Layer: Receives the frames from the physical layer and applies Frame Check Sequence (FCS) on eachframe for any error (1), if no errors found, it de-encapsulates each frame contents (2), strips (discards) any PPP orHDLC Header and Trailer (3), and Handles ONLY the IP packet to the Network Layer (3).

Network Layer: Receives and reads the IP Packet’s destination and source IP addresses (1), compares destinationIP (172.16.10.20) to known IP routes or subnets by reading the Routing Table Entries to analyze 172.16.10.20’ssubnet – Bingo! 172.16.10.0/24 Subnet found, which includes addresses 172.16.10.1 through 172.16.10.254 (3),Now the Routing decision: the subnet’s route states: 172.16.10.0 is directly connected using f0/0 interface asoutgoing interface (4), and routes the IP packet using f0/0 interface as outgoing interface through the Data-link Layer(5). (directly connected, which means, there is no more routing can be done for this subnet, since this route

connected directly to R1)

Note: 172.16.10.0 is directly connected using f0/0 >>> directly connected, meaning, there are no more routers inthe middle to route to for this subnet, since this route connected directly to R1, and f0/0 belongs to R1 as outgoingLAN interface

Data-link Layer – R1′s Downstream using Ethernet LAN Port: Receives the IP Packet back from the NetworkLayer and encapsulates it inside a NEW Ethernet Header and Trailer forming a NEW Frame (1), adds new destinationMAC address of web-server’s NIC (1001.3333.3333) as next-hop based on ARP cache table (2), adds new sourceMAC address of R1’s f0/0 (1001.1111.1111) interface as a sender (3), and forwards the New Frame using R1’s f0/0 asoutgoing interface through the Physical layer (4).

Physical Layer: Physical Layer receives the New Frame from the Data link layer and converts it to bits (1), sinceEthernet copper cable is used, encodes the bits into electrical signals (2), and transmits the electrical signals one at atime using R1’s f0/0 outgoing interface, through the LAN network heading to web-server (3).

Step 5 - IP Packet hits its final destination using Web-Server’s Upstream NIC:

Web-Server’s Physical Layer: Receives the signals from R1’s Physical layer through R1’s f0/0 interface and de-encode each electrical signal as bit stream (1), reassemble each bit stream as frame (2), and handles each frame tothe upper layer – Data-Link Layer (3).

Web-Server’s Data-link Layer: Receives the frames from the physical layer and applies Frame Check Sequence(FCS) on each frame for any error (1), if no errors found, it de-encapsulates each frame contents (2), strips (discards)any Ethernet MAC address with its Header and Trailer (3), and Handles ONLY the IP packet to the upper layer –Network Layer (3).

Web-Server’s Network Layer: Receives and reads the IP Packet’s destination and source IP addresses (1),compares its destination IP (172.16.10.20) to it’s IP Address and found out that it is the same IP address as the web-server’s IP address – Bingo!, the IP packet reached its final destination (2), it de-encapsulates the IP Packet andhandle the Segment to the upper layer – Transport layer (3).

Web-Server’s Transport Layer: Receives and de-encapsulates the segments supplied by the Network Layer,analyze any destination TCP or UDP source port numbers, and finally handle the Data to the Application Layer’sservice based on the TCP or UPD destination port Number used inside the segment.

That is: Web-Server’s Transport Layer receives and de-encapsulates the segments supplied by Network Layer (1),analyzes the segment’s destination TCP or UPD port fields (2), based on segment’s destination port number analysis,transport Layer decides that this port is TCP port type number 80 (3) , based on this port number, it handles the Dataheader to HTTP Service that is associated with port 80 and responsible to respond and process Web pages data.

Web-Server’s Application Layer: receives any headers that include data from the lower layer – Transport Layer, andhave it’s application services process any data based on the port numbers was analyzed previously by the TransportLayer.

That is: Web-Server’s HTTP Service processing the Data since it was meant to its TCP port 80, and found out it is aGET Message Request from PC1 to view a website called ccnahub.com which is hosted by the Web-Server.

*Please Note: that most Routers do NOT deal with either Transport Layer Nor Application layer! Starting at thePhysical layer and up to ONLY the Network layer, Routers receive the Frame then the IP Packet as Upstream, thenRouters route the IP Packets through Data Link Layer using NEW Frames with New Hardware Address that issuitable to medium used as Downstream to the Next-Hop.

Post Office Concept – Mapped to TCP/IP Concept

Corporate Director as Layer 5: Notice, how the Application Layer acted similar to a corporate director in a companywhere he wrote an urgent letter to his branch office manager in New York.

Corporate Director as Layer 4: decided to handle the letter to his secretary as is without envelope, and instruct herto packet and send it to the branch office manager in New York Office using a guaranteed delivery feature – actingsimilar to Transport Layer’s TCP feature.

Secretary as Layer 3: At this point, the corporate director doesn’t really care how the secretary would pack the letter,such what kind of envelope would she use or how the secretary would decide to put the envelope on the mailing box.The secretary job at this stage is very similar to the Network Layer. The secretary way of working similar to an IPProtocol functions of PC1. She (IP) decided to encapsulate the letter inside an express mail envelope using the NewYork branch office destination mail address – which is equal to the IP destination address of Web-server as a receiver– and used the source mailing address of her corporate office as a sender– which is similar to the source IP addressof PC1 as sender.

Corporate Mail Man as Layer 2: the secretary prepared everything and called the corporate mail man for furtheractions – which is very similar to Data-Link Layer. The mail man put or encapsulated the secretary envelope (Packet)in his special mailing box and carries it to his car in order to deliver it the closest Post Office (R3) using the corporateMail man car that has a plate number (MAC Address)– which is very similar to a MAC address. Obviously the Mailman can’t drive to New York, so the closest router to his office is one of the Post office sites (R) for further routing.Next, choosing to use his car, and not a bicycle, is very similar of using an Ethernet Header and Trailer controlprotocol. If the Mail man had chosen a bicycle instead, that would mean he had chosen to pick a different Data-LinkLayer protocol such PPP WAN.

Driving a car with (Ethernet plate or MAC number) on the Road as Layer 1: the corporate mail man drove on theroad to drop the envelope at the closest Post office box which is very similar of using a UTP cable between PC1 andR3. Obviously, there is no way that we can encode the Mail man and his car as electric signal yet, but at least we canmap the idea to better understand the theory of TCP/IP Networking Model which is similar at some points to the PostOffice Networking Model.

Person sending a Letter: the process from Corporate Director as Layer 5 up to Layer 4 is very similar to someonewrote a letter but didn’t put the letter inside an envelope, rather, he handled it to the secretary to do the job.

Post office: The process from the Secretary (Network Layer) up to driving on the Road (physical Layer) is a completePacket Routing and Frame Forwarding Process; therefore, the last three layers act as internal Post Office belongs tothe corporate office; a theory makes each network device has a complete TCP/IP Networking “Mini-Post Office”Model.

MAC addresses as a Mail Ethernet Vehicle: MAC addresses are used as a lower layer to keep processing of IPPacket routing moving till it reaches its final destination. MAC addresses are similar to the Post Office’s trucks,planes, or personal (each one of them carries a plate number) that keeps handling each other the mail till they deliverit to its final destination. Now Ethernet can’t represent all of them but one of them, let’s say the Airplane Medium!

Please Note: this Article explained the flow of Segments, Packets, and Frames among network devices. Moredetailed steps for the following Protocols were not included in this Article.

DNS: As seen on the above figure, we used ccnahub.com address as domain name, we said that Domain NameResolution (DNS) resolved the domain to IP address, but we didn’t go through the DNS details. Why DNS? You andme use words and can’t remember all IP addresses around the world, e.g google.com and once entered in thebrowser it has to be translated from a Name to a dotted decimal number, that is, Public IP address used bygoogle.com ISP router. In order to translate a Host name or a Domain name like google.com, Network Layer MUSTrelay on Domain Name System (DNS) to provide layer 3 with destination IP address, DNS work back and fourthbetween Application Layer and Network Layer 3 and it can be configured at your Router as well. Understanding Web

Browser DNS Lookup Article explains the basics of how Layer 3 depends on DNS to complete the packet with adestination IP address by translating a Domain Name entered by user to a Public IP address.

ARP: Data-link layer (if Ethernet Technology is used) relays on Address Resolution Protocol (ARP) which is part of(Network Layer 3 protocols functions) to create frames with destination MAC address, this Article’s examples and forsake of simplicity bypassed ARP requests detailed steps, this Article assumed that ARP table already populated withMAC addresses on each network device ARP Table. Understanding ARP Request Process Article will further explainwhy ARP needed in the Beginning of initializing a communication between the network devices if Ethernet standard isused.

NAT: At the above examples, we used Private IP addresses among all the networks and subnets. In reality it’s little bitdifferent though, Private IP addresses to Public IP addresses translation or NAT will be involved. To get the point, let’ssay you have requested the home page of google.com from your home or office PC, (assuming you are using IPv4network) a very critical component called “Network Address Translation” (NAT) will be involved in order to translatebetween Private IP addresses (which are used at your home or your office network) and a Public IP addresses (whichare used by your ISP Router and google ISP router), NAT functions at your home or Office Router. UnderstandingNAT Article is coming soon to further explain the concept in how it works by looking at the same examples but usingNAT, DNS, and ARP all together.

Next: Understanding How IP Packets are Routed Back

Go to top

About Imad Daou He is the founder of CCNA HUB, a CCNA Training HUB to help CCNA students get certified. Imad has more than 10years of IT experience as Field Service and Consulting Engineer. A+, Network+, Server+, Security+, Storage+, HP,Dell, and IBM Hardware Certified. He's a Professional SMB IT Consultant.

Facebook • Twitter • Linkedin • Google •

Copyright secured by Digiprove © 2013 Imad DaouSome Rights Reserved

Original content here is published under these license terms: X

LicenseType:

Attribution, Share Alike

LicenseSummary:

You may copy this content, create derivative work from it, and re-publish it, provided you include anovert attribution to the author(s) and the re-publication must itself be under the terms of this license orsimilar.

LicenseURL:

http://creativecommons.org/licenses/by-sa/3.0/

Copyright © 2014 CCNA HUB. All rights reserved.