Packet Flow Across Networks

The walk-through

This is worth working through slowly, out loud, the first few times. It's the single best way to check that all the pieces from this module and the last one actually fit together instead of sitting in your head as separate facts.

1. Is the destination local? The sending host compares the destination IP (Internet Protocol) address against its own subnet mask. Same subnet, and it can ARP (Address Resolution Protocol) for the destination directly and send straight to it at Layer 2.
2. Not local: ARP for the gateway. If the destination is on a different network, the host doesn't ARP for the destination at all. It ARPs for its default gateway's MAC (Media Access Control) address, since that's who it actually needs to hand the frame to next.
3. The gateway does a routing lookup. The router receives the frame, strips the Layer 2 header, and looks at the destination IP. It checks its routing table using longest prefix match to find the most specific route, decrements the packet's TTL (Time to Live) by one, and rewrites the Layer 2 header with the next hop's MAC address.
4. Possibly NAT, at the edge. If this router sits at the boundary of a private network, it may also rewrite the packet's source IP (and port, under PAT, or Port Address Translation) before sending it onward, recording the translation in its NAT (Network Address Translation) table so the reply can find its way back.
5. Repeat, hop by hop. Every router along the path repeats step 3: look up longest prefix match, decrement TTL, rewrite the Layer 2 header, forward. The IP header's source and destination addresses never change in transit. Only the Layer 2 addressing and the TTL do, at every hop.
6. Arrival, and the trip back. The destination network's router ARPs for (or already knows) the final host's MAC address and delivers the frame. Any reply retraces a route, possibly a completely different one, back toward the original sender. Routing tables on each side don't have to agree on a single shared path.