20 min read Packets & Routing Lesson 4 (of 13)
Part 2 — Packets, Routing & Transmission Protocols

Lesson 04 — How Data Travels Across the Internet

Packet Slicing, Multi-Layer Encapsulation & Hop-by-Hop Routing Mechanics

What We Will Master in This Lesson

By the end of this lesson, every layer of digital transit and how routers forward data across thousands of miles will be crystal clear:

  • Why internet data is strictly chopped into packets
  • What a packet is and its internal architecture
  • How messages navigate multi-layer protocol stacks
  • Relationship between frames, packets, and segments
  • How routers inspect headers and forward traffic
  • Routing tables and the "Next Hop" philosophy
  • Dynamic multi-path routing across the global mesh
  • Why MAC addresses rewrite while IP remains constant
  • TTL (Time To Live) and routing loop prevention
  • Packet loss, congestion, and MTU boundaries
  • Complete 10-step end-to-end trace of a real chat message from phone to server

1 A Simple Question

Suppose you type and send a quick message to a colleague or friend on WhatsApp, Slack, or Messenger:

"Hello!"

To your human eyes, this is merely a 6-character piece of casual greeting. But to the vast, decentralized global Internet, it is far more than just the word "Hello!".

This tiny snippet of digital information must be packaged so precisely across copper cables, transoceanic glass fibers, and radio waves that:

  • Its origin is indisputable: Exactly where it came from (Source IP and Source Port).
  • Its destination is unambiguous: Exactly where it needs to go (Destination IP and Destination Port).
  • It can traverse foreign networks: Hop safely across hundreds of routers and switches owned by independent commercial transit providers.
  • Transmission corruption is detected: If electromagnetic noise flips a single bit in flight, the receiver can catch and reject the defect.
  • It reaches the correct software application: Upon arriving at the target computer, it is delivered straight to the chat process rather than Spotify, the browser, or a background game.

This brings us to the foundational cornerstone of all modern internetworking:

📦 The Packet

2 What is a Packet?

Stated in plain engineering terms:

A packet is a discrete, standardized unit of data formatted for transmission across a computer network.

Suppose you want to transmit a high-resolution photo or 4K video clip measuring 10 Megabytes (10 MB).

The Internet does not blast this 10 MB payload down the optical wire as one gargantuan, unbroken block of electrical continuous signal. Instead, transport software systematically slices that payload into thousands of small, manageable units:

Large Data Stream (10 MB Image File)
↓ Data Slicing (Segmentation) ↓
Packet 1 [1.4 KB]
Packet 2 [1.4 KB]
Packet 3 [1.4 KB]
Packet 4 [1.4 KB]
Packet ...N
↓ Independent Routing Across Global Fiber/Radio ↓
Destination Reassembly → Original 10 MB File Restored

Once these individual packets reach the destination machine, they are sorted by their sequential ordering numbers (Sequence Numbers) and stitched back together into the original file.

Technical Terminology Nuance: In casual speech, engineers frequently refer to any transmission chunk as a "packet." However, in formal network models (OSI and TCP/IP), the term Packet specifically designates a Network-Layer (Internet Protocol) Protocol Data Unit (PDU). Above and below this layer, data units carry distinct names and structural packaging.

3 Multiple Layers Inside a Single Message

When your browser requests a webpage or your phone transmits a chat message, that information cascades down through distinct software and hardware layers before touching the physical wire.

Observe this classic, elegant layered transformation:

1 Application Layer: Application Data (HTTP Request or Chat Payload "Where are you?")
↓ Transport Header Added ↓
2 Transport Layer: TCP Segment / UDP Datagram (Ports & sequence numbers attached)
↓ Internet/Network Header Added ↓
3 Network Layer: IP Packet (Source IP, Destination IP, TTL attached)
↓ Data-Link Header & Trailer Added ↓
4 Link Layer: Ethernet / Wi-Fi Frame (Source MAC, Destination MAC, CRC attached)
↓ Modulated into Physical Waves ↓
5 Physical Layer: Physical Signals (Voltage transitions, optical laser flashes, RF radio waves)

The exact same message is wrapped in progressively broader headers as it descends the network stack. This universal wrapping mechanism is termed Encapsulation.

4 What is Encapsulation? The Courier Analogy

Comparing network transmission to an international courier shipment makes encapsulation instantly intuitive:

Real-World Courier Pipeline
  1. Letter / Gift: The actual item you wish to convey (raw payload).
  2. Padded Envelope: Labeled with the recipient's internal office room number.
  3. Courier Shipping Box: Affixed with a standardized destination zip code and barcode.
  4. Intermodal Cargo Container: Sealed onto a flatbed semi-truck for highway freight.
Digital Network Encapsulation
  1. Application Data: The raw text payload or HTTP HTML document.
  2. TCP Segment: Attaches port numbers identifying target software processes.
  3. IP Packet: Attaches globally routable IP addresses and hop limits.
  4. Link Frame: Attaches local hardware MAC addresses for physical transit.
"Every protocol layer appends its own necessary control metadata (Header) to the incoming data and delegates the resulting package downward."

5 The Critical Components of an IP Packet

Let us zoom directly into the IP Packet. While an IP header contains multiple metadata fields, from a pure routing standpoint, its primary anatomy consists of:

IP HEADER (Control Metadata · 20 to 60 Bytes) Protocol, TTL, Routing Addresses
Version (IPv4/v6)
Header Length (IHL)
TTL (Hop Limit)
Protocol (TCP=6/UDP=17)
Source IP: 192.168.1.20 (Where it originated)
Destination IP: 203.0.113.80 (Where it must go)
PAYLOAD (The carried passenger: TCP Header + Encrypted Application Data)

To every router spanning the global core, two fundamental questions dictate every forwarding choice:

1. Where did it come from? (Source IP)
2. Where does it need to go? (Destination IP)

By parsing the Destination IP, the router answers: "Which physical port or fiber strand must receive this packet to steer it closer to its target?"

6 What is the Role of a Router?

In earlier lessons, we learned that a router binds distinct local networks together. From a packet's perspective, however, a router is an intelligent traffic intersection conductor.

The instant a packet enters an ingress port, the router confronts this core query:

"Given this Destination IP, out of which physical egress interface and toward which neighbor router should I forward this packet?"

Routers do not guess or flip coins. They consult a rigorously maintained internal routing database known as the Routing Table.

7 What is a Routing Table?

A routing table is an in-memory database of destination network prefixes and their corresponding outgoing interfaces or gateway addresses.

Simplified Representative Routing Table
Destination Network Gateway / Next Hop Interface Interpretation
192.168.1.0/24 Directly Connected eth0 (LAN) Local home laptops, phones, smart TVs
10.0.0.0/8 192.168.1.254 tun0 (VPN) Corporate enterprise intranet tunnel
172.16.0.0/12 10.10.1.1 eth2 Partner peering interconnection
0.0.0.0/0 (Default Route) 103.14.22.1 (ISP Gateway) wan0 (Fiber/ONT) All remaining global destinations across the entire world!

The router executes a bitwise Longest Prefix Match (LPM) against the Destination IP. If no specific subnet matches, it falls back to the catch-all Default Route (0.0.0.0/0), pitching the packet directly to upstream ISP infrastructure.

8 What is the "Next Hop"?

This is arguably the most brilliant architectural abstraction behind global Internet scalability.

Suppose your laptop sits in London, while the target server resides in an AWS data center in Frankfurt. Your residential Wi-Fi router has zero knowledge of the twenty intermediate switches and trans-Channel submarine cables along the way. Nor does it need to!

"A router does not know the full planetary path. It only knows its immediate neighbor—the Next Hop—that moves the packet one step closer."
Home Router → Only knows: Next Hop: Local ISP Aggregation Router A
ISP Router A → Only knows: Next Hop: National Core BGP Backbone B
BGP Backbone B → Only knows: Next Hop: International Undersea Gateway C
Carrier Transit → Only knows: Next Hop: Destination Datacenter Edge Router
Datacenter Switch → Direct delivery: Target Server Blade!

This is why the Internet is described as a decentralized Hop-by-Hop Packet Forwarding Architecture.

9 A Real Journey: 10 Concrete Steps

Let us trace a packet dispatched from a laptop at private IP 192.168.1.20 requesting a web resource at destination IP 203.0.113.80.

Here is the exact step-by-step physical and logical choreography:

Step 1 Application Data Formatted

The browser synthesizes an HTTP GET command: GET /index.html.

Step 2 Transport Segment Packaged

The operating system binds a TCP header (Source Port 52140, Dest Port 443, Sequence Number 1).

Step 3 IP Packet Assembled

Network layer appends Source IP 192.168.1.20, Destination IP 203.0.113.80, and initial TTL 64.

Step 4 Link-Layer Frame Wrapped

The laptop computes that the destination IP is remote; it puts the home router's LAN MAC as Destination MAC.

Step 5 Physical Transmission

The laptop's Wi-Fi chip modulates the frame into 5 GHz electromagnetic radio waves.

Step 6 Router Ingress & Decapsulation

The router antenna demodulates the signal, verifies the frame checksum, and strips the link-layer header.

Step 7 Routing Decision & TTL Decrement

The router checks its routing table, decrements TTL to 63, performs NAT, and selects its optical WAN port.

Step 8 Next Hop Forwarding (WAN Fiber)

A brand-new frame is wrapped with the ISP gateway's MAC address and flashed down the optical fiber.

Step 9 Core & Submarine Hop-by-Hop Transit

The packet traverses multiple Tier-1 transit and submarine cables; each router decrements TTL by 1.

Step 10 Server Ingress & Delivery

Target datacenter server strips the link and IP headers, delivering the HTTP GET command to port 443!

10 Critical Insight: How MAC Addresses Change at Every Hop

Here lies one of the most common stumbling blocks for junior network engineers.

When your laptop sends a packet toward an overseas server (203.0.113.80), what is the destination MAC address on the outgoing frame? Is it the server's MAC? Never!

The destination MAC address is your home router's LAN interface. A MAC address has local scope only; it cannot travel beyond the immediate physical switch or wireless access point.

Hop-by-Hop MAC Rewriting vs End-to-End IP Constancy:

Hop 1: Laptop → Home Router (Local Wi-Fi Link)
Source MAC: AA:AA:AA:AA:AA:AA (Laptop) | Dest MAC: BB:BB:BB:BB:BB:BB (Router LAN)
Source IP: 192.168.1.20 | Dest IP: 203.0.113.80
Hop 2: Home Router → ISP Gateway (Fiber WAN Link)
Source MAC: CC:CC:CC:CC:CC:CC (Router WAN) | Dest MAC: DD:DD:DD:DD:DD:DD (ISP OLT)
Source IP: Public IP (via NAT) | Dest IP: 203.0.113.80 (Unchanged!)
Hop 3: ISP Router → Core Transit Router (Metro Backbone)
Source MAC: EE:EE:EE:EE:EE:EE (ISP Core) | Dest MAC: FF:FF:FF:FF:FF:FF (Transit Core)
Source IP: Public IP | Dest IP: 203.0.113.80 (Unchanged!)
MAC Addressing Strictly local-link oriented (Hop-by-hop local delivery). A brand-new frame is synthesized at every hop; MACs change constantly.
IP Addressing Globally network oriented (End-to-end delivery). The Destination IP remains locked on the target server across continents.

11 Does Data Always Take a Single Fixed Path?

The Internet is not a fixed, rigid railway track. Beginners often imagine:

Router A → Router B → Router C → Server D (Always 100% Fixed)

In reality, fluctuating link congestion, fiber-optic cuts, and geopolitical routing policy updates mean paths can alter on the fly:

Path A (Standard Conditions): Your Router → ISP A → Carrier A → Destination Server Lowest propagation latency and direct undersea cable path.
Path B (Undersea Cable Outage): Your Router → ISP A → Carrier B → Terrestrial Relay → Destination Routers dynamically re-route around failures to keep traffic flowing.

The Internet is not a single road; it is an interconnected, self-healing dynamic mesh of independent networks.

12 An Important Nuance: Flow Affinity

A critical clarification must be made here.

This does not mean that every individual packet in a single video stream wanders off down completely random global paths.

Modern commercial routers calculate a 5-Tuple Flow Hash (Source IP, Destination IP, Source Port, Destination Port, Protocol). All packets belonging to the exact same TCP stream are mapped to the same physical link (a principle called Flow Affinity). This prevents packets from arriving wildly out-of-order.

However, if that primary link suffers congestion or failure, the router recalculates routes and transitions the flow to an alternate path. This flexibility makes the Internet remarkably resilient.

13 Do Routers Inspect the Entire Packet?

Under standard operations, a transit router does not inspect your chat message, bank transfer details, or video pixels!

"A router only reads the Network-Layer Header (Destination IP) to determine outgoing interface forwarding."

If you send: "Send me the photo."
The transit router has neither the curiosity nor the computational budget to decode what you requested. It simply checks the outer shipping label: Destination: 203.0.113.80.

(Note: Specialized security appliances, corporate firewalls, and Deep Packet Inspection (DPI) boxes may inspect payloads for malware or policy enforcement, but core transit backbone routers process IP headers exclusively.)

14 How Do Routers Make Decisions So Blazingly Fast?

Carrier-grade core routers forward tens of Terabits per second. How can they perform millions of route lookups every millisecond without melting down?

Modern routing engines decouple their operations into two clean planes:

Control Plane (The Brain) Runs routing protocol daemons (BGP, OSPF, IS-IS) on general CPUs to negotiate network maps with neighboring routers and build the Routing Information Base (RIB).
Data / Forwarding Plane (The Muscle) Custom ASIC silicon and Ternary CAM (TCAM) search the Forwarding Information Base (FIB) in nanoseconds, switching packets from input ports to output line-cards at wire speed.

15 Why Packets Carry a TTL (Time To Live / Hop Limit)

Consider a dangerous failure mode in routing logic: a misconfiguration causing an endless forwarding circle:

Router A → Router B → Router C → Router A → Router B ... (Infinite Routing Loop!)

If packets looped forever, billions of trapped packets would saturate global fiber bandwidth, bringing down the entire planetary Internet within hours!

To neutralize this threat, every IP packet includes a fail-safe counter:

TTL — Time To Live (Renamed Hop Limit in IPv6)

Despite the historical word "Time," modern routers treat TTL strictly as a Maximum Hop Counter:

  • 1. The sending device initializes the packet with a preset TTL (typically 64, 128, or 255).
  • 2. Every router that forwards the packet must decrement TTL by exactly 1 (TTL = TTL - 1).
  • 3. If TTL ever reaches 0, the router instantly drops the packet and transmits an ICMP Time Exceeded (Type 11) diagnostic back to the sender!

This mechanical death sentence guarantees that no rogue packet can loop indefinitely.

16 Will a Packet Always Reach Its Destination?

The blunt answer is: No!

The Internet Protocol (IP) provides an unvarnished "Best-Effort" delivery service. It makes a good-faith attempt to forward packets, but provides zero delivery guarantees. Packets can and do get dropped due to:

🚦 Network Congestion
💥 Buffer Overflow
✂️ Severed Cables
📡 Wireless Interference

How do we recover from lost packets?

Through Transport Layer Protocols. Protocols like TCP track acknowledgments (ACKs) and automatically retransmit dropped data. Meanwhile, UDP trades reliability for real-time speed, discarding dropped frames without recovery. (We dive deep into TCP vs. UDP in Lesson 05!)

17 What is Network Congestion?

Imagine a highway tunnel designed for 2,000 cars per hour into which 20,000 vehicles attempt to surge at once. Traffic grinds to a dead halt.

In computer networks, when incoming packet volume exceeds a router's hardware buffer queues (Queue Buffering), the router has no physical memory left to hold the backlog. It has no choice but to discard arriving packets (Tail Drop):

Direct Symptoms of Congestion:
• Skyrocketing round-trip latency (Ping spikes)
• Heavy packet drop rates triggering transport backoff
• Video streaming degradation, stuttering, and voice call dropouts

18 Why are Packets Small?

Segmenting large files into ~1.5 KB packets delivers four monumental architectural advantages:

1. Multiplexing & Efficiency Millions of users can share the same fiber trunk. One person's 50 GB game download does not monopolize the wire and block someone else's urgent chat message.
2. Localized Error Recovery If electromagnetic noise corrupts 1 KB out of a 10 MB download, only that single 1 KB packet needs to be retransmitted—not the entire 10 MB payload!
3. Dynamic Routing Flexibility Intermediate switches and routers can steer individual packets across alternate links to load-balance congested routes.
4. Hardware Manageability Fast SRAM memory on line-cards can store and switch small, predictable buffer blocks at wire speed with minimal silicon real estate.

19 Is Packet Size Unlimited? (MTU)

No. Physical transmission mediums have strict physical and hardware limits on the maximum frame size they can carry in a single burst:

MTU — Maximum Transmission Unit

On standard Ethernet and modern Wi-Fi links, the default MTU is 1500 Bytes.

If an IP packet exceeds the MTU of a downstream link, an intermediate router must either chop it into smaller fragments (IP Fragmentation) or discard it and issue an ICMP "Fragmentation Needed" signal (used in Path MTU Discovery).

20 What Else Lives Inside an IP Packet?

A complete IPv4 packet header contains standard control flags and fields:

  • Version: IPv4 vs IPv6 identifier
  • IHL: Internet Header Length in 32-bit words
  • Total Length: Entire packet size (Header + Payload)
  • TTL / Hop Limit: Loop defense decrementer
  • Protocol: Inner payload type (TCP=6, UDP=17, ICMP=1)
  • Checksum: Bit-error verification code for the header
Core Rule: Do not stress over memorizing every bit offset. Simply remember: Headers exist for network management and control; Payloads contain the user's valuable application data.

21 Header vs. Payload

Visualize this clean separation in your mind:

+--------------------------------------------------------------+
| HEADER |
| Source IP | Destination IP | TTL | Protocol | Checksum... |
+--------------------------------------------------------------+
+--------------------------------------------------------------+
| PAYLOAD |
| Actual Carried Application Data |
| "Where are you?" (Message) |
+--------------------------------------------------------------+

Header states: "What does the network need to know to safely forward this data?"
Payload states: "The actual user content being ferried from origin to destination."

22 The Complete Bidirectional Journey: From Message to Signal and Back

Observe the full architectural lifecycle from the sender's encapsulation down to physical waves, and the receiver's decapsulation back up to application display:

Originating Endpoint (Encapsulation)
Application: "Give me this webpage"
↓
Transport: TCP Segment (Ports Attached)
↓
Internet: IP Packet (IP & TTL Attached)
↓
Link Layer: Ethernet / Wi-Fi Frame
↓
Physical Layer: Electrical / Optical / Radio Waves
Receiving Endpoint (Decapsulation)
Physical Layer: Analog waves demodulated into bits
↑
Link Layer: MAC verified & Frame unpacked
↑
Internet: IP verified & Packet unpacked
↑
Transport: TCP Segment verified & ordered
↑
Browser / Process: Webpage Rendered!

23 A Crucial Correction: "Data Travels as Bits"

People often assert: "Data flies through the Internet as zeros and ones!"

While conceptually true in mathematics, physically it is incomplete. There are no microscopic numbers etched into glass cables. Data travels strictly as Physical Analog Waveforms:

  • • In copper Ethernet: High-frequency voltage differentials (+2.5V / -2.5V)
  • • In optical fiber: Infrared laser pulses modulated across specific light wavelengths
  • • In Wi-Fi / Cellular: Electromagnetic radio frequencies shaped via Quadrature Amplitude Modulation (QAM)

Notice how our foundational CS concepts from Course 01 interlock seamlessly: Bits → Signals → Local Links → Global Internet → Remote Servers.

24 A Complete Concrete Example: "Where are you?"

You type and send: "Where are you?" on your mobile phone.

Here is the 11-stage chronicle of how that brief phrase circumnavigates the earth:

  1. 1. Chat App: Encodes the text string into UTF-8 bytes.
  2. 2. Transport Layer: Binds TLS encryption and TCP port headers.
  3. 3. IP Layer: Appends device IP, cloud server IP, and sets TTL to 64.
  4. 4. Link Layer: Encloses packet inside an 802.11 Wi-Fi frame targeting the home router's MAC.
  5. 5. Physical Layer: Emits radio waves through the phone's internal antenna.
  6. 6. Home Router: Decapsulates the frame, decrements TTL to 63, and fires the packet onto fiber.
  7. 7. ISP Backbone: BGP routers evaluate destination prefixes at line speed.
  8. 8. Transoceanic Fiber: Optical amplifiers propel laser pulses across deep-sea cables.
  9. 9. Target Cloud Server: Chat server decapsulates headers and notifies the friend's account.
  10. 10. Friend's Smartphone: Decapsulates the radio frame, verifying checksums.
  11. 11. Friend's Screen: The crisp notification pops up: "Where are you?"

To the user, it feels instant. Underneath, a global symphony of layered computer engineering executed seamlessly within milliseconds!

25 Today's 5 Core Engineering Pillars

Keep these 5 non-negotiable principles at the heart of your engineering intuition:

1 Data Slicing: Bulk payloads are partitioned into discrete packets to ensure fair network multiplexing and rapid error recovery.
2 Encapsulation: Every protocol layer prepends its own control metadata, preserving clean separation of architectural concerns.
3 Forwarding Decisions: Routers inspect the Destination IP against a routing table using Longest Prefix Matching to choose outgoing ports.
4 Hop-by-Hop Delivery: Routers do not map entire global trajectories; each device simply forwards to the optimal Next Hop.
5 Physical Realization: Digital bits ultimately traverse physical infrastructure as voltages, laser light pulses, and modulated RF waves.

26 Where We Stand & What's Next

Let us review our milestone progress across the Internet roadmap:

What is the Internet? → A global federation of autonomous networks
↓
Physical Infrastructure → Fiber-optic lines, submarine cables & data centers
↓
Device Identity → MAC addresses, IP addressing, subnets & DHCP
↓
Data Transmission → Packets, Encapsulation, Routers & Next-Hop

Now we face a major engineering paradox:

"On a best-effort Internet where packets can be delayed, corrupted, or dropped, how do we guarantee reliable communication?"

Financial transactions and software updates cannot tolerate lost bytes. Conversely, multiplayer video games and live audio require lightning speed over guaranteed delivery.

Coming Up in Lesson 05: TCP, UDP & Port Numbers!

In Lesson 05, we explore the legendary 3-way handshake of TCP, why UDP fuels real-time communication, and how Port Numbers ensure your 50 open browser tabs never cross wires.

Hands-On Laboratory

Interactive Packet Journey & Routing Lab

Simulate hop-by-hop forwarding, explore encapsulation layers, and evaluate routing table decisions

Origin: 192.168.1.20 → Target: 203.0.113.80
💻 Laptop
192.168.1.20
📡 Home Router
192.168.1.1
🏢 ISP Aggregation
103.14.22.1
🌐 Core Transit
198.51.100.2
🖧 Web Server
203.0.113.80
Current Hop Inspection Hop 0: Origin (Laptop)
Source IP (End-to-End) 192.168.1.20
Dest IP (End-to-End) 203.0.113.80
Current TTL (Hop Limit) 64
Local Link Protocol 802.11 Wi-Fi
Source MAC (Local Link Only) AA:11:BB:22:CC:33 (Laptop NIC)
Destination MAC (Next Hop Link Only) BB:22:CC:33:DD:44 (Router LAN)

Laptop assembled the data packet and set destination MAC to the local gateway router. No routing hops have occurred yet; TTL = 64 remains at maximum value.

Knowledge Check

Lesson 8.4 Quiz — Packets & Routing Mechanics

Verify your mastery of packet encapsulation, hop-by-hop forwarding, and TTL protection

1. As a packet crosses dozens of routers across the globe, how do its MAC and IP addresses behave?

2. What is the fundamental purpose of the TTL (Time To Live / Hop Limit) field in an IP packet?

3. Which sequence correctly represents top-down Encapsulation as application data prepares for physical transmission?