Frames, packets, streams, and forwarding

Prerequisites: Binary representation, processes, and basic graph terminology.

Learning objectives

• Distinguish link frames, IP packets, and transport streams.
• Trace next-hop forwarding across a router.
• Separate serialization delay from propagation delay.

Layering divides communication responsibilities into interfaces. A link layer carries frames across one local link. IP carries packets across interconnected networks using destination addresses and routing tables. A transport protocol connects application endpoints; TCP presents an ordered byte stream, while UDP presents individual datagrams. Application protocols define message meanings. A layer's interface is useful precisely because it hides some lower-level details, but debugging requires knowing which promises it does not make.

Imagine a laptop sending data to a server outside its subnet through a router. The laptop chooses the router as its next hop, then resolves the router's local link address, using ARP on a typical IPv4 Ethernet network. The Ethernet destination is the router's interface; the IP destination remains the remote server. The router removes the incoming link framing, processes the IP packet, selects an outgoing next hop, and creates a new frame for that link. Link addresses normally change hop by hop. End-to-end IP addresses remain the same in this simplified example without address translation or tunnels.

A switch forwards frames using link-layer information within its scope. A router forwards packets between networks using a network-layer table. These are logical roles, not necessarily separate boxes. The routing control plane learns or configures paths; the forwarding data plane applies the resulting table to each packet. A valid route does not guarantee that the remote application is listening or that return traffic can follow a usable path.

Framing identifies message boundaries on a link. TCP, in contrast, does not preserve application write boundaries. Sending five bytes and then seven bytes may be received in one twelve-byte read or several smaller reads. An application must define framing, perhaps with a fixed-size length header, a delimiter with escaping, or a fixed-size record. It must also handle a header arriving in pieces and reject unreasonable declared lengths.

Delay has multiple components. Serializing a 1500-byte packet onto a 100-megabit-per-second link takes 1500×8/100000000 seconds, or 120 microseconds, excluding additional link overhead. Propagation time depends on distance and signal speed. Queueing depends on competing traffic. A faster link reduces serialization but does not make a distant receiver physically closer.

The maximum transmission unit limits packet size on a link. Path changes, encapsulation, and blocked control messages can complicate discovering a usable end-to-end size. Larger application messages may need segmentation rather than assuming one network packet can hold them. Diagnose the layer where evidence changes: name lookup, route selection, neighbor resolution, transport establishment, and application response are separate checkpoints, each capable of succeeding while the next fails.

Practice problem

A host at 192.0.2.10/24 sends a TCP application message to 198.51.100.20 through gateway 192.0.2.1. Describe the destination IP and destination Ethernet address on the first hop, then explain what the router changes. The application writes a 4-byte length header and a 100-byte body. Explain why a receiver that assumes one read returns the complete 104 bytes is incorrect, and give a correct high-level receive procedure.

Worked solution

The first-hop IP destination is 198.51.100.20, while the Ethernet destination is the gateway interface’s resolved link address. The router chooses an outgoing next hop, decreases the IP hop limit or TTL as appropriate, and replaces link framing; in the stated no-NAT model it does not replace the final destination IP. TCP may deliver any available prefix of the stream per read. The receiver must accumulate exactly four header bytes, decode and validate the advertised length against a limit, then accumulate exactly that many body bytes or handle EOF and errors. Separate application writes do not create preserved message boundaries.

Check your understanding

A host sends to a remote subnet via a local gateway without NAT. Which first-hop destination pair is expected?

• Both addresses name the remote server.
• IP=remote server, Ethernet=local gateway.
• Both addresses name the DNS resolver.
• IP=local gateway, Ethernet=remote server.

Explanation

The frame reaches the local next hop while the packet carries the final IP destination.

An application writes a 4-byte header and 100-byte body to TCP. The receiver’s first read returns 2 bytes. What should it infer?

• The body must be exactly 2 bytes.
• The connection should be closed because one read must match one write.
• The sender violated TCP framing.
• It must accumulate the rest of the header, then the declared body, subject to validation and errors.

Explanation

TCP is a byte stream and does not preserve application send-call boundaries.

Primary reading

• Ethernet Address Resolution Protocol, RFC 826: IETF / RFC Editor
• Transmission Control Protocol, RFC 9293: IETF / RFC Editor

Open the study and save your work →