UNDERSTANDING BASIC PACKET FLOW

In this document we will walk through how the packet flows when the communication happens from a host machine on network with another host machine on different network.

Let us take the simple topology as below to understand the packet flow:

 

 

In the above topology we will try to ping from Host A to Host B and will check the packet flow at each link.

At the very beginning of this communication when we first power on the devices there a Gratuitous ARP frame sent out from Host A which will have below packet structure.

In this GARP we see the host A sends its own IP address in Sender and Target IP Address field to check for any duplicity of this IP on the network. The destination address is a broadcast address and hence once switch will receive this packet it will forward it through all its ports.Immediately after the GARP we see the ARP comes to switch from Host A looking to IP-MAC mapping for its default gateway address 10.1.1.2.

 

Packet looks as below:

 

 

 

We see an ARP request comes from Host A for its default gateway address 10.1.1.2 which is again a broadcast. Switch 1 forwards the broadcast frame from its all ports and once this frame is received on Router 1 it replies with its MAC address of E0/0 interface in Target MAC field. This is then relayed back to the Host A to resolve its ARP table for 10.1.1.2.

 

Switch also updates its CAM table with MAC addresses as below:

When GARP frame is received switch 1 gets to know that Host A MAC address connects to interface E0/0.When ARP replies comes from router switch 1 also learns Router’s E0/0 interface address on its E0/1 port.

This same procedure happens on the second leg where Router 2, Switch 2 and Host B connect.

Now when we try to ping from 12.1.1.2 from 10.1.1.1 an ANDing operation is performed by Host A based on which Host A comes to know the network lies in different network and hence it forwards the packet to its Default Gateway.When this packet crosses the switch 1 it will simply forward the packet without changing anything.

 

Capture from Host A to Switch 1 link:

 

Capture from Switch 1 to Router 1 link:

 

Host A MAC address is: aabb.cc00.0600  

Router 1 E0/0 interface MAC address:

We nothing is changed on the packet as it crosses the switch.

 

Now let us capture the link between Router 1 to Router 2:

 

 

MAC address of Router 1 E0/1 and Router 2 E0/0 interface:

Here we see when packet traverses from Router 1 to Router 2 only the source and destination MAC addresses are changed but src-dst IP remain the same.

 

Till now our packet has reached from Host A to Router 2.

Router 2 can also send an ARP request for 12.1.1.1 IP address if not already resolved.

 

ARP reply from Host B:

 

Once this ARP is resolved for Host B the packet gets forwarded as below:

 

Source IP and Dst IP remain the same.Src MAC is the MAC of E0/1 interface of Router 2.Dst MAC is the MAC of Host B.

Switch 2 forwards this frame as it is to Host B and is seen in the capture below:

 

The same way packet travels back from Host B to Host A where now the Dst IP is 10.1.1.1 and Src IP is 12.1.1.2.

ABOUT THE AUTHOR