IP Packet Flow
Watch a packet travel from host to server.
Open full screen ↗ recommended on mobile (rotate to landscape)
How to read it
Each tower is a device, and each square is a layer of the TCP/IP stack (4 layers, not OSI's 7): Physical, Link, Internet, and Transport — applications live above the stack (the dashed boxes) and use it through sockets:
- 4-square tower — a host: the full stack up to Transport, with the application on top.
- 3-square tower — a router: understands IP (Internet layer) but nothing above it.
- 2-square tower — a switch: understands Ethernet frames (Link layer) but nothing above it.
Going down a tower the packet gains headers (encapsulation); going up it loses them (decapsulation). Host B runs a server listening on TCP port 80, and each header block in the packet shows its destination: the Ethernet frame carries the next-hop MAC, the IP header the final host, and TCP the port that picks the listening process. Hover over any square for a hint about what that layer does there.
Key takeaways
- Encapsulation: each layer on the way down wraps the payload in its own header; each layer on the way up removes and inspects one.
- Switches are Layer-2 devices: they forward frames by MAC address and never modify (or even see) the IP packet inside.
- Routers are Layer-3 devices: they terminate the incoming Ethernet frame, make a routing decision on the IP header, and build a new frame for the next link.
- Destination MAC is near, destination IP is far: the frame is addressed to the next hop only
(Host A sends to
r1:r1, the gateway — not to Host B's MAC), while the IP header is addressed to the final host (10.0.2.20) the whole way. Watch the address readout under the caption: the ETH pair changes at the router, the IP pair never does. - Frames are per-hop, IP is end-to-end: the Ethernet header changes on every link, while the IP header (except TTL and checksum) travels unchanged from source to destination.