An animated walk-through of an IP packet travelling from host to host through the TCP/IP layer stack — encapsulation, switching, routing, and decapsulation.
Watch a packet travel from host to server.
How to read it
Each tower is a device, and each square is a layer of the TCP/IP stack (4 layers, not OSI's 7):
Physical, Link, Internet, and Transport — applications live above the stack (the
dashed boxes) and use it through sockets:
- 4-square tower — a host: the full stack up to Transport, with the application on top.
- 3-square tower — a router: understands IP (Internet layer) but nothing above it.
- 2-square tower — a switch: understands Ethernet frames (Link layer) but nothing above it.
Going down a tower the packet gains headers (encapsulation); going up it loses them
(decapsulation). Host B runs a server listening on TCP port 80, and each header block in the packet
shows its destination: the Ethernet frame carries the next-hop MAC, the IP header the final
host, and TCP the port that picks the listening process. Hover over any square for a hint about what
that layer does there.
Key takeaways
- Encapsulation: each layer on the way down wraps the payload in its own header; each layer on the
way up removes and inspects one.
- Switches are Layer-2 devices: they forward frames by MAC address and never modify (or even see)
the IP packet inside.
- Routers are Layer-3 devices: they terminate the incoming Ethernet frame, make a routing decision
on the IP header, and build a new frame for the next link.
- Destination MAC is near, destination IP is far: the frame is addressed to the next hop only
(Host A sends to
r1:r1, the gateway — not to Host B's MAC), while the IP header is addressed to
the final host (10.0.2.20) the whole way. Watch the address readout under the caption: the ETH
pair changes at the router, the IP pair never does. - Frames are per-hop, IP is end-to-end: the Ethernet header changes on every link, while the IP
header (except TTL and checksum) travels unchanged from source to destination.