Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking for some good video lectures / book / articles which explains in a simple manner how exactly how packet moves in Internet. Searched the net, but couldnt find a GOOD one. Want to know how packets moves, importance of MAC address, how IP and MAC address are related.. Looking for a step by step guide. Some thing like From Power Up To Bash Prompt

share|improve this question
Almost every CCNA study guide will cover most of this material, though it will be aimed at Cisco hardware. – Zoredache May 22 '11 at 9:00
Reminds me of a question I was once asked in a job interview-- to explain what happens when a user puts the company's URL into their browser. I responded with "Do you want me to start w/ bit-banging the keyboard controller or can I start higher-level than that?" >smile< – Evan Anderson May 22 '11 at 9:52
up vote 3 down vote accepted

I wrote about IPv4 subnetting and routing in an earlier posting. I didn't talk about layer 2 / layer 3 interaction there so, being that I'm stuck in a hospital waiting for a friend's baby to be born, I'll go ahead and expound here a bit.

IP, being a layer 3 protocol, gets encapsulated into a layer 2 protocol when IP datagrams are put onto a physical (layer 1) medium. Address Resolution Protocol (ARP) helps to facilitate the layer 2 communication to encapsulate the layer 3 traffic between hosts. (ARP can be used by layer 3 protocols other than IP and by layer 2 protocols other than Ethernet, but for the purposes of this example I am sticking with IP over Ethernet.)

As simplistic example, imagine two hosts with IP addresses and subnet masks configured such that both hosts are in the same subnet. These hosts are connected to the same Ethernet broadcast domain. It would be possible for these hosts to communicate by way of Ethernet broadcasts, however that would make inefficient use of the broadcast medium (switches flooding the frames to all destinations, which is also a bit of a security risk though relying on Ethernet switches not to forward unicast traffic as a security mechanism is laughable). The most efficient use of the Ethernet medium would be for each host to communicate to the other by way of packets addressed to the unicast Media Access Control (MAC) address of the other host. ARP allows the hosts to "learn" each others MAC address to facilitate this unicast communication.

  • Host A: IP address, MAC address 00:01:de:ad:be:ef
  • Host B: IP address, MAC address 00:01:0b:ad:f0:0d

Host A has a datagram to be delivered to host B. Host A consults its cache of previously learned MAC to IP address mappings (known as the ARP cache) and finds no entry matching the datagram's destination address ( Host A transmits an ARP packet, addressed to the Ethernet broadcast destination address (ff:ff:ff:ff:ff:ff), essentially "asking" the question "Who has the IP address assigned?". Because this is a broadcast packet the Ethernet switch floods this frame to all destinations.

Host B receives this packet, detects that its own IP address is in the "target protocol address" field of this broadcast ARP packet (the "question"), and responds with an ARP packet, addressed to the MAC address of host A (which it "learned" from the broadcast ARP request, sent from host A's MAC address) with its own MAC address substituted in the "target hardware address" field of the ARP packet.

Host A receives the ARP response from host B. With the information contained in the response it then has sufficient knowledge to address the IP datagram, when encapsulated into an Ethernet frame, to the MAC address of host B. This results in unicast traffic from host A to host B.

To prevent the need for an ARP exchange for each datagram each host maintains a cache of the IP to MAC mappings that it "learns" for a period of time. The cache typically has a maximum possible size and expiration of the mappings prevents the table from filling. Expiration of the mappings also allows a host to communicate with a different MAC address (possibly as a result of changing out a network interface card or for other reasons). Typical ARP cache expiration times range from under one minute to several minutes.

In the case of hosts separated by routers the ARP process is the same as the process described above, except that it occurs between the sending host and the router to which it will be sending the packets for final delivery. Typically, a host would ARP for its default gateway (as most hosts don't have multiple static routes configured but, rather, have only a single router to a default gateway configured). Once a host has the IP to MAC mapping for its default gateway and IP datagrams bound for hosts in other subnets will be encapsulated in Ethernet frames addressed to the MAC address of the default gateway router.

share|improve this answer

Juniper has some excellent tutorials for getting started and explaining the basics of the OSI (layered) model of networking. These are meant to get you started and go for JNCIA certification, but they really are excellent. They are audio/graphic driven. You may have to create an account on their support site, but that is free.

share|improve this answer

The MIT has a lot of free lectures on this topic which should be pedagogically sound. E. g.

Some of them are a little dated, but the technology has not changed in essence in the last decade, so the answers to the questions you ask are still the same. Here's the index on CompSci if you would like to see for yourself what else is there.

share|improve this answer

Well there are good ones but those cost money and take time to read/watch and understand. Warriors of the Internet is kinda amusing but I wouldn't call it in depth.

I took a look at Networking Head First it covered a lot of what you are talking about plus a lot of other stuff you could skip.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.