AnyLearn
All lessons
Computer Scienceintermediate

Layers, Frames, and the Wire

A packet is a stack of nested envelopes, and the bottom layer has rules of its own. Work through encapsulation, Ethernet frames, MAC learning inside a switch, ARP, and MTU, then diagnose the classic failure where small requests succeed and large ones hang forever.

Updated · AI-authored, review-gated · how lessons are made

networkingethernetarpmtuencapsulationswitchingosi-modelpacketsmss-clampingpmtud
Part of:How Computer Networks Actually Work
Not signed in: your progress and quiz score won't be saved.
Progress1 / 11

Why we layer, and where the model lies

Layering is a contract about ownership. Each layer treats what sits above it as opaque bytes it must deliver, and what sits below it as a pipe whose internals are none of its business. Ethernet moves frames across one link. IP moves packets across networks. TCP turns a lossy packet service into an ordered byte stream.

The seven-layer OSI model is a teaching device, not a description of the internet. The stack that actually shipped is the four-layer model of RFC 1122: link, internet, transport, application. Even that leaks:

  • TLS sits between transport and application and belongs cleanly to neither.
  • NAT is a layer 3 box that rewrites layer 4 port numbers to do its job.
  • MPLS is routinely nicknamed "layer 2.5" because it fits nowhere.
  • A VPN carries IP inside IP, so the whole stack nests twice.

Treat layering as a map of who owns which header, not a law of physics.

Full lesson text

All 11 steps on one page, for reading, reference, and search.

Show

1. Why we layer, and where the model lies

Layering is a contract about ownership. Each layer treats what sits above it as opaque bytes it must deliver, and what sits below it as a pipe whose internals are none of its business. Ethernet moves frames across one link. IP moves packets across networks. TCP turns a lossy packet service into an ordered byte stream.

The seven-layer OSI model is a teaching device, not a description of the internet. The stack that actually shipped is the four-layer model of RFC 1122: link, internet, transport, application. Even that leaks:

  • TLS sits between transport and application and belongs cleanly to neither.
  • NAT is a layer 3 box that rewrites layer 4 port numbers to do its job.
  • MPLS is routinely nicknamed "layer 2.5" because it fits nowhere.
  • A VPN carries IP inside IP, so the whole stack nests twice.

Treat layering as a map of who owns which header, not a law of physics.

2. How the headers nest

Each layer prepends its own header to whatever the layer above handed down. Nothing rewrites the payload; it only gets wrapped.

flowchart TD
  A["HTTP request bytes"]
  B["TCP header plus HTTP bytes equals a segment"]
  C["IP header plus segment equals a packet"]
  D["Ethernet header plus packet plus trailer equals a frame"]
  E["Electrical or optical symbols on the link"]
  A --> B
  B --> C
  C --> D
  D --> E

3. Counting the bytes

Abstract nesting becomes concrete once you count. A standard Ethernet link carries at most 1500 bytes of IP packet. Subtract the headers and you get the largest chunk of application data a single frame can hold.

| Ethernet 14 B | IPv4 20 B | TCP 20 B | payload <= 1460 B | FCS 4 B |
<--------------------- 1518 bytes on the wire ---------------------->
                 <----------- 1500 byte MTU ----------->

That 1460 is the TCP maximum segment size, or MSS: 1500 minus a 20-byte IPv4 header minus a 20-byte TCP header. Swap in IPv6, whose header is a fixed 40 bytes per RFC 8200, and the MSS drops to 1440. Add TCP timestamps and the options field eats another 12 bytes.

So a full frame carries 1460 useful bytes out of 1538 transmitted, once you count the 8-byte preamble and the 12-byte interframe gap. About 95 percent efficiency, and that is the best case.

4. The Ethernet frame, field by field

IEEE 802.3 fixes the layout that every wired and wireless bridge on earth understands:

FieldSizeWhat it holds
Preamble and start delimiter8 BAlternating bits so the receiver locks onto the clock
Destination MAC6 BWho this frame is for, on this link only
Source MAC6 BWho sent it, on this link only
EtherType2 B0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP, 0x8100 VLAN tag
Payload46 to 1500 BThe IP packet
Frame check sequence4 BCRC-32 over the frame

The 46-byte payload floor is why the minimum frame is 64 bytes. In the original CSMA/CD design a frame had to stay on the wire long enough for a collision at the far end of the segment to propagate back before the sender finished transmitting. Short payloads get zero-padded. Modern switched full-duplex links have no collisions, but the floor stayed for compatibility.

The CRC is a drop test, not a repair: a corrupt frame is discarded silently and TCP finds out later.

5. What a MAC address actually identifies

A MAC address is 48 bits, usually written as six hex bytes. The first three bytes are the Organizationally Unique Identifier assigned by the IEEE to a hardware vendor; the remaining three are the vendor's serial space. Two bits in the very first octet carry meaning: the low bit marks multicast, and the next bit marks a locally administered address that no vendor ever registered.

The critical property is scope. A MAC address is meaningful only on one link. Look at a frame leaving your laptop for a server in another country: the destination MAC is your own router, not the server. Every router along the path strips the Ethernet header, decrements the IP TTL, and writes a brand new frame with new source and destination MACs for the next hop. The IP addresses stay put for the whole journey; the MAC addresses are rewritten at every single hop.

Modern iOS and Android set the locally administered bit and rotate a random MAC per network, precisely because a stable MAC is a tracking identifier.

6. Hubs, switches, and how a switch learns

A hub is an electrical repeater. Bits in on one port go out every other port. Everyone shares one collision domain, the link runs half duplex, and every machine can read every frame.

A switch is a bridge with a lookup table. It reads the source MAC of each arriving frame and records "this MAC lives behind port 7" in its forwarding table, often called a CAM table. When a frame arrives for a MAC it has learned, it sends the frame out that one port. When it has not learned the MAC yet, it floods the frame to every other port and learns from the reply.

HubSwitch
ForwardingRepeat to all portsLook up destination MAC
Collision domainsOne, sharedOne per port
DuplexHalfFull
Broadcast domainOneStill one, unless VLANs split it

Gotcha: a switch does not stop broadcasts. ARP requests, DHCP discovery, and mDNS still reach every port, which is why very large flat layer 2 networks drown in broadcast traffic.

7. ARP: the glue between IP and Ethernet

Your machine wants to send an IP packet to 10.80.251.251 but the frame needs a destination MAC. The Address Resolution Protocol, specified in RFC 826 back in 1982, fills that gap. The host broadcasts "who has 10.80.251.251, tell 10.80.251.127" to ff:ff:ff:ff:ff:ff. The owner replies by unicast, and the answer goes into a cache with a short timeout.

> arp -a
Interface: 10.80.251.127 --- 0x3
  Internet Address      Physical Address      Type
  10.80.251.251         ba-6f-29-f1-d0-6c     dynamic
  10.80.251.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.251           01-00-5e-00-00-fb     static

ARP has no authentication whatsoever. Any host can answer any request, which is the entire basis of ARP spoofing on an untrusted LAN. The same lack of checks makes gratuitous ARP a useful failover tool: a standby machine claiming a shared IP simply announces the new mapping and every switch updates.

IPv6 dropped ARP for Neighbor Discovery over ICMPv6 (RFC 4861), which uses multicast instead of broadcast.

8. MTU: the ceiling every link imposes

The maximum transmission unit is the largest IP packet a link will carry. It is a property of the link, not of your host, and the path MTU is the minimum across every hop.

LinkMTUWhy
Classic Ethernet1500The 802.3 default everyone assumes
Datacenter jumbo frames9000Fewer per-packet interrupts at high rates
PPPoE on DSL14928 bytes of PPPoE header
IPv6 minimum link1280RFC 8200 requires every link to carry at least this
WireGuard tunnelcommonly 1420Its own header plus a UDP and IP header

The pattern to internalise: every tunnel steals bytes. GRE, IPsec, VXLAN, and WireGuard all wrap your packet in another packet, so the inner MTU has to shrink. RFC 8200 states that "IPv6 requires that every link in the Internet have an MTU of 1280 octets or greater," which is the one floor you can rely on for IPv6.

9. Fragmentation, and why IPv6 refuses to do it

If an IPv4 packet is too big for the next link, a router can chop it into fragments and let the destination reassemble. The IP header carries an identification field, a fragment offset, and a More Fragments flag to make that work.

It is a bad deal in practice:

  • Reassembly happens only at the destination, so every fragment must survive the whole remaining path. Lose one and the entire original packet is lost.
  • Only the first fragment carries the TCP or UDP header, so firewalls and load balancers that match on port numbers cannot classify the rest.
  • Reassembly buffers are a denial-of-service target, and the 16-bit identification field wraps quickly at high rates.

IPv6 removed the option. RFC 8200 is blunt: "fragmentation in IPv6 is performed only by source nodes, not by routers along a packet's delivery path." A router with a packet too large simply drops it and returns an ICMPv6 Packet Too Big message. Discovering the path MTU stops being optional and becomes the sender's job.

10. Path MTU Discovery, and how it fails

Path MTU Discovery, defined in RFC 1191, is elegant. The sender sets the Don't Fragment bit on every packet. Any router that cannot forward one drops it and returns ICMP type 3 code 4, Fragmentation Needed, with the next-hop MTU in the message. The sender shrinks and retries.

You can run the same probe by hand. The payload plus 28 bytes of ICMP and IP header gives the packet size:

> ping -f -l 1472 1.1.1.1
Reply from 1.1.1.1: bytes=1472 time=38ms TTL=51

> ping -f -l 1473 1.1.1.1
Packet needs to be fragmented but DF set.

1472 plus 28 is exactly 1500, so this path has a clean Ethernet MTU.

The failure mode is that PMTUD depends entirely on ICMP arriving. Plenty of firewalls drop all ICMP as a reflex. The sender then never learns anything, and this is where the classic bug is born. RFC 8899 defines Datagram Packetization Layer PMTUD, which probes from the transport layer instead and never trusts ICMP; QUIC uses it.

11. The bug: small requests work, large ones hang

The symptom is unmistakable once you have seen it. SSH connects and then freezes the moment you cat a big file. An API returns 200 for small payloads and times out on large ones. A site loads its HTML and stalls on images. Everything small works; everything large hangs.

The mechanism: the TCP handshake is three tiny packets, and a short request fits in one small frame. Both cross a 1420-byte tunnel happily. Then the first full 1500-byte response segment arrives at that tunnel, is dropped because DF is set, and the ICMP that would explain it is blocked. The sender has no loss signal beyond a missing ACK, so it retransmits the identical oversized segment, and backs off exponentially. Forever.

The fix is to stop generating oversized segments rather than to fix ICMP you may not control. MSS clamping rewrites the MSS in the SYN as it passes:

iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
  -j TCPMSS --clamp-mss-to-pmtu

Diagnostic shortcut: if the DF ping stops working somewhere between 1400 and 1500 bytes, you have found your culprit.

Check your understanding

The lesson ends with a 5-question quiz. Take it in the player above to see your score.

  1. A packet travels from your laptop through four routers to a server. What changes at each hop?
    • The source and destination IP addresses are rewritten; the MAC addresses stay the same.
    • The source and destination MAC addresses are rewritten; the IP addresses stay the same.
    • Both the IP and MAC addresses are rewritten at every hop.
    • Neither changes; only the TTL field is decremented.
  2. On a standard 1500-byte Ethernet MTU carrying IPv6 instead of IPv4, what is the TCP MSS with no TCP options?
    • 1460 bytes
    • 1500 bytes
    • 1440 bytes
    • 1280 bytes
  3. A switch receives a frame whose destination MAC is not in its forwarding table. What does it do?
    • Drops the frame and sends an error back to the sender.
    • Broadcasts an ARP request to discover which port owns that MAC.
    • Floods the frame out every port except the one it arrived on.
    • Buffers the frame until the destination sends traffic of its own.
  4. SSH to a server connects fine but freezes as soon as you display a large file. Nothing in the logs shows an error. What should you suspect first?
    • A Path MTU Discovery black hole caused by ICMP being filtered on the path.
    • TCP congestion control collapsing the window to zero.
    • An ARP cache entry that expired mid-session.
    • The server's frame check sequence rejecting corrupted frames.
  5. Why does IPv6 forbid routers from fragmenting packets in transit?
    • IPv6 headers have no room for fragment offset information.
    • IPv6 links are all required to support jumbo frames, so fragmentation is unnecessary.
    • Router fragmentation was moved into ICMPv6 instead of the IP layer.
    • In-path fragmentation forces reassembly at the destination, so one lost fragment destroys the whole packet and only the first fragment carries port numbers.

Related lessons

Programming
advanced

Pods, Services, and the Label That Joins Them

The object types look like an arbitrary vocabulary until you notice they are layers of controllers, each reconciling the one below. This lesson works up from the pod, explains why a Service can point at something whose address changes constantly, and shows that the whole system is joined by one mechanism: a label match.

8 steps·~12 min
Programming
advanced

Networking and Storage: Connecting an Isolated Thing

Isolation is the point, and a container that can reach nothing and keep nothing is useless. This lesson covers how a network namespace is wired to the outside, why published ports and container-to-container traffic work completely differently, and where data has to live given that the writable layer disappears.

8 steps·~12 min
Computer Science
intermediate

DNS, HTTP, and the Move to QUIC

Before a byte of HTTP moves, a name has to become an address. Follow the full resolution path from stub resolver to authoritative server, see how TTLs govern change, then trace head-of-line blocking from HTTP/1.1 through HTTP/2's TCP problem to HTTP/3 running on QUIC over UDP.

12 steps·~18 min
Computer Science
intermediate

TCP: Reliability, Windows, and Congestion

TCP turns a lossy packet service into an ordered byte stream, and almost every performance surprise on the internet comes from how it does that. Work through the handshake, cumulative ACKs, retransmission timers, the two windows, slow start and AIMD, CUBIC versus BBR, bufferbloat, and when to reach for UDP instead.

13 steps·~20 min