Packet walk through a network
Follow a packet hop by hop: switching inside a VLAN, routing between subnets, ARP, MAC rewrites and longest-prefix forwarding.
Inside the subnet
A packet between subnets changes hands at each hop: the Layer 2 frame (source/destination MAC) is rewritten by every router, while the Layer 3 packet (source/destination IP) stays the same end to end. The host sends the frame to its default gateway's MAC, not the destination's.
Across the router
End-to-end sequence
- PC computes that the destination is off-subnet (its mask says so) → needs the default gateway.
- PC ARPs for the gateway IP → learns gateway MAC → encapsulates frame to it.
- Switch floods/learns as normal → frame reaches the router interface.
- Router strips L2, looks up destination in its routing table (longest-prefix match), decrements TTL, re-encapsulates for the next hop.
- Final router finds a connected route → ARPs for the server → delivers.
Encapsulation at each hop
| Hop | Src MAC | Dst MAC | Src IP | Dst IP |
|---|---|---|---|---|
| PC → R1 | PC MAC | R1 G0/0 MAC | PC IP | Server IP |
| R1 → R2 link | R1 G0/1 MAC | R2 G0/0 MAC | PC IP | Server IP |
| R2 → Server | R2 G0/1 MAC | Server MAC | PC IP | Server IP |
IP addresses are constant; MACs are rewritten per link.
Worked packet walk
- PC
- 10.1.1.10/24, gw 10.1.1.1
- R1
- G0/0 10.1.1.1, G0/1 10.2.2.1
- Server
- 10.2.2.20/24
- PC: 10.2.2.20 is outside 10.1.1.0/24 → send to gateway 10.1.1.1.
- PC ARPs for 10.1.1.1 (not for the server) → builds frame PC_MAC → R1G00_MAC.
- R1 receives, looks up 10.2.2.0/24 → connected on G0/1 → ARPs for 10.2.2.20 on that interface.
- R1 rewrites frame R1G01_MAC → Server_MAC, TTL decremented, delivers.
The server sees source IP 10.1.1.10 but source MAC R1-G0/1 — L3 source constant, L2 rewritten.
Verification
Verify forwarding hops and ARP resolution — Privileged EXEC
Cisco IOS / IOS XE
show ip route show arp traceroute <ip> show mac address-table
- Routing table shows the next hop used per prefix.
- ARP table proves which next-hop MAC the router resolved.
- Traceroute lists the L3 hops the packet actually took.
Read-only verification commands.
Common mistakes
- Believing the PC sends the frame to the server's MAC — the frame always goes to the gateway's MAC off-subnet.
- Thinking MACs travel end-to-end — they are link-local and rewritten by every router.
- Expecting the source IP to change — nothing rewrites it (except NAT, a different topic).
- Forgetting TTL decrement — a router that cannot route drops, not forwards forever.
Observation: tracert completes the gateway but stars at hop 2.
- Hop-2 router has no route to the destination
- Return path missing — replies can't get back
- ICMP TTL-exceeded filtered at hop 2 (probe artifact, not a real failure)
| Check | Indicates |
|---|---|
show ip route <dest> on hop 2 | Missing route confirms a real routing gap. |
| End-to-end ping to the final destination | If it succeeds, the traceroute gap is filtered ICMP, not a path failure. |
| Routes on the destination side back to the source | Asymmetric or missing return routes break replies. |
Correction: Add the missing route (or its return) — or accept filtered traceroute as normal if traffic flows.
Ping and application traffic succeed; traceroute either completes or only the filtering hop stars.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 791 — Internet Protocol — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.