SimulatorUnit 3 Primer
Packet flow: follow a frame across switches and routers
Follow a frame across switches and a router, hop by hop.
New to this? Read the topic first: Primer: Networks.
Simulation · Packet flow [3.1.C.1, 3.4.A.2]
Simulator: follow one packet to a website
A laptop opens an HTTPS (hypertext transfer protocol secure) website. Follow its first packet link by link and watch which addresses change.
| Link | Source MAC | Destination MAC | Source IP | Destination IP | TTL |
|---|---|---|---|---|---|
| 1. Laptop to router | 3c:52:82:4a:9f:10 | 00:1b:a9:3e:71:01 | 10.20.4.31 | 203.0.113.50 | 128 |
| 2. Router to firewall | 00:1b:a9:3e:71:02 | 58:8d:09:2c:10:a1 | 198.51.100.2 | 203.0.113.50 | 127 |
| 3. Firewall to internet | 58:8d:09:2c:10:a2 | 7c:21:0e:55:0b:01 | 198.51.100.2 | 203.0.113.50 | 126 |
| 9. Internet to server | 7c:21:0e:9a:33:01 | 9c:b6:54:21:7e:30 | 198.51.100.2 | 203.0.113.50 | 120 |
Changed since the link before: highlighted. The payload stays encrypted on every link; devices read only the headers. MAC (media access control) addresses deliver a frame across one link. IP (internet protocol) addresses carry the packet end to end. TTL (time to live) drops by 1 at every router. A link is the path between two devices that route; the switch does not start a new link.
Read the steps without the simulator
- The laptop builds the packet. The IP header holds source 10.20.4.31 and destination 203.0.113.50, the TCP (transmission control protocol) header holds destination port 443, and the payload is encrypted by HTTPS. 203.0.113.50 is not in 10.20.4.0/24, so the laptop wraps the packet in a frame addressed to its default gateway's MAC address, which it learned with ARP (address resolution protocol).
- The switch forwards the frame. It reads the destination MAC address, finds the router's port in its MAC address table and sends the frame only there. It changes nothing.
- The router passes the packet to the next network. It removes the old frame, lowers the TTL (time to live) from 128 to 127 and wraps the packet in a new frame for the next link. Here the router also swaps the private source address 10.20.4.31 for a public one, 198.51.100.2 (network address translation, beyond the CED; on some networks the firewall does this instead). The destination IP address does not change.
- The firewall checks the headers. This firewall is stateless: it decides from header information such as IP addresses, ports and protocol [3.4.A.2], and it cannot read the encrypted payload. A rule allows outbound TCP to port 443, so the packet passes. The firewall also routes, so it lowers the TTL from 127 to 126 and writes a new frame for the link to the internet.
- The internet routers repeat the same job. Six more routers each lower the TTL by 1 and write a new frame for the next link (links 4 to 9), so the packet arrives with TTL 120.
- The web server receives it. The last frame is addressed to the server's MAC address. On every link the MAC addresses were new, but the destination IP address, 203.0.113.50, never changed. An adversary who captures the packet on a link can read these headers (who is talking to whom, and on which port) but not the encrypted payload. Network vulnerabilities that let adversaries intercept data in transit are a risk to confidentiality [3.1.C.1].
Check yourself: which address was the same on every link?
The destination IP address, 203.0.113.50. The MAC addresses change on every link because each frame only crosses one link. The source IP address changed once, at the router, because of network address translation.