Layer 2 and Layer 3 Walk-through

This is a summary of a lot of the concepts that we have already learned, walked through end to end at layer 2 and layer 3.

Is the destination local or remote?

In our scenario, we have a machine over here that is trying to talk to a server in another remote network. We are going to send this packet, this information, this request over to that server.

The first thing that needs to happen is determining whether the IP address it is destined for is remote or local. It knows, number one, its own IP address, and it knows the subnet mask that it is part of. We are just going to say this is a class C address, so it is a 255.255.255.0. What it will do is a process called ANDing to determine what network this is a part of. The network it is a part of is 192.168.0.0.

It also knows the destination IP address, and it probably got this through something like DNS, so it knows the IP address of where it is trying to reach. It is trying to reach 192.168.164.24.

Finding the default gateway's MAC address

Once it determines that this machine is on a remote network and is not within its local network, it needs not the MAC address of the end destination. It does not need the MAC address of this server right here. It needs the MAC address of its default gateway. It has an assigned default gateway on it, and it comes in as an IP address, 192.168.0.1.

The first thing it can do is look at its own ARP table and see if it has already got that information, because if it has gotten that information in the past, it is going to already be on that machine and it is going to keep that information for a period of time. If it sees that it does not know that information, it needs to find out what MAC address is associated with 192.168.0.1.

So it sends out an ARP request to the switch asking who belongs to 192.168.0.1. The switch is going to broadcast that message out to all of the other machines and ask, "Hey, who belongs to 192.168.0.1?" This router right here is going to send the MAC address of itself back to the switch in response, which is then going to forward it on to this machine right here. Now this machine has the MAC address that is associated with the IP address, and it is going to put it inside of its ARP table so it has a record of that for future use. That way it does not have to go through this whole communication again just to find out what MAC address is associated with this IP address.

One more important thing to note is that as this ARP request happened, as information was coming through and passing through the switch, it also looked at the source MAC addresses of the frames that were going through it, and it was keeping track of the MAC address and the port that it was coming in on. That is going to be important for forwarding future frames through this network, because now, rather than broadcasting information out everywhere when it comes in destined for a certain MAC address, it knows specifically what port to send it across.

Assembling the packet and the frame

In this process it has already created new frames and new packets. We kind of skipped over that part, but now comes the packet that is actually going to be sent and destined for this end location.

It now has an IP address. It knows the IP address of the final destination, and it knows its own IP address, so it is going to put that into this packet. It is going to put that checksum in there, and it is going to form the time to live and how big this packet is. It is going to form all of the information that we said exists within the header of the packet, so that information can get from this machine all the way to that server.

The next thing it needs to do is assemble the frame that is going to go across Ethernet, since in our example here this is going to be an Ethernet line, and it is going to a certain MAC address. So it puts that MAC address into the frame. It also assembles that cyclical redundancy check at the end, that frame check sequence at the end, that is going to double check to make sure the frame has not changed or been altered. It is going to put in how big that frame is, and put in all that information.

Then when it puts it onto the line, it is actually going to send that preamble, which is the little ones and zeros that set the signaling timing and get the two devices communicating from a physical standpoint, and then send that frame across to the switch. That switch, because it has been recording those MAC addresses during this transaction and the port that each is on, will take that frame, look at the destination MAC address, and send it off to this router right here.

The first router: layer 2 in, layer 3 out

That router is going to receive it. It takes a look at layer 2 and looks at the MAC address and asks, is this frame destined for myself? That router takes a look at it and says, "Well, yes, this MAC address lines up with my MAC address. This is for me. I am going to do the frame check sequence, the cyclical redundancy check, just to make sure nothing has been altered, that nothing has been changed." It checks out. So now it can take away that layer one and layer two and get rid of it all together. It does not need that information. Now it is going to process the layer three.

So now we have the packet that exists on this router. This router is going to start picking apart that packet and take a look at the destination IP address. It sees that destination IP address and it is going to do a lookup on its routing table and determine what is the longest match, or the best match, to whatever destination network this is supposed to go to. In this case right here, we will say that it understands - maybe we statically assigned - that this remote network right here exists and that it needs the next hop of this router right here. So it looks up that information in the routing table.

One thing it had done before this is take a look at that checksum to make sure the header has not changed. But one thing that does change before it sends the packet on to its next location is that it takes that time to live and increments it down by one. It subtracts one from that time to live. If that time to live is zeroed out, then it just gets rid of that packet; it does not send it on. But if it is still good, and in this case it is still good, and it has decremented it, it needs to create a new checksum for that header, because the header has changed.

It does that lookup to find that remote network, it figures out what the next hop is, and then it can send it along its way to the next hop. To send it along its way, it realizes it needs to assemble the layer 2 information to actually get it onto the line, the layer two and the layer one to get it sent over. So the router is going to form a new frame to put it on here and send it to the next location.

In this case, let us say this is an Ethernet connection, because we are used to dealing with Ethernet connections. So maybe it needs the MAC address. It looks at its own ARP table to see what MAC address is associated with the end IP address over here. If it does not have that information, it will send an ARP request out and get the MAC address response back for this interface associated with that IP address. Now it has the MAC address. It can go through and form that header for the frame using that destination MAC address. It uses its own interface for the source MAC address. It will also do that frame check sequence to make sure the frame and nothing in it has been altered.

It will do that signaling where it puts that little preamble on the line, the little ones and zeros to get the two clocks adjusted on the two interfaces so it knows what to sync up and what to send. Then it will send that frame across to the other side.

The next hop and a different layer 2 protocol

It will get to this router, and that router goes through the same process of taking a look at whether the MAC address is mine, and whether anything has been altered and changed on that frame, by doing the frame check sequence. Once it determines yes, this is destined for me, everything is fine, it can rip away that layer 1 and layer two, and now it has got the packet.

So that layer three packet has come into that router. That router has started processing it. It has figured out what the next hop is to the network that is associated with the destination IP address. It has done a check to make sure that the header has not changed or been altered. It decrements the time to live. It does a new frame check, because that has changed now since we did the decrement of the time to live.

Now it needs to get it to the next router. Let us say that this is a different protocol in here. Let us say it is not Ethernet. Maybe this is just a point-to-point connection. That actually has a different addressing scheme to it. So it assembles the different addressing scheme that is associated with the point-to-point protocol and then sends it along its way to this router right here.

Delivery on the directly connected network

This router gets it and once again goes through that same process, the process that would be associated with point-to-point protocol, where it checks the address and does all the checks that it needs to do. It takes the layer three out of that and takes a look at the destination IP address. When it looks it up and finds it in the routing table, it determines that that is actually a directly connected network.

Once it does what it needs to do with the time to live and the checksum and makes sure everything is good, it realizes this is the Ethernet, and what it needs to do, being a directly connected network, is send it directly to the MAC address of this machine right here. It checks its ARP table to see if it knows what the MAC address is associated with that IP. If it does not, it does that same ARP request and requests, hey, who belongs to this MAC address right here. It will get a response back.

Meanwhile, this switch right here is recording where all those MAC addresses are coming from and the ports associated with them. So when this router reassembles that frame with the destination MAC address of this server, it sends it out into this network. This switch looks at the destination MAC address and then forwards it down the port that is associated with that MAC address, and it gets to the end machine.

Now that frame comes into this server. That server takes a look and once again checks the frame to see if the MAC address matches up with its MAC address. And it does. It checks to make sure nothing has been altered in the frame and then accepts that frame. It unpacks the layer three, unpacks the layer four, unpacks the layer five, and builds it up to figure out what this request is. Then it responds to that request.

How fast all of this happens

We have talked about layer two and layer three and how traffic travels from one location to another. But what is incredible about this is that it happens very quickly. It happens almost instantaneously, seemingly, that it gets transferred from one location to another. It is extremely fast.

And not only have we transferred this request going from this computer to this server, but the server is probably replying. So if this is a website that we are downloading, then it is going to send a stream of packets back to this machine. Every once in a while this machine will do an acknowledgement and say, "Yeah, I am getting this," just to make sure that it is not sending off into the blind. And this is all happening at crazy speeds. It is breaking up pictures, it is breaking up data, and sending it across this line and coming back to you and displaying it here.

The technologies that happen out there are incredibly vast. There are lots of different technologies, but this is essentially how the communication happens. At this point you can see how we can transfer data clear across this planet, and how the internet works by this model right here.