Need help understanding how packets travel across the internet

Question

I've been learning about networks recently at a new job, and I did a presentation on what I've learnt so far. When I was describing the relationship between the datalink and network layer, I mentioned that datalink handles the hops while network is end to end. After I was done they grilled me with some questions, and one of them asked me if the datalink layer handles packets traveling across the internet, to which I replied yes. They told me I was wrong, but I didn't ask them for the right answer because I was nervous and it really didn't cross my mind to ask. But now that I've gone back to researching this topic I'm starting to get confused and I was hoping I could have someone clear this up for me. Was I wrong? Or perhaps I explained it poorly? Here's my knowledge so far:

The packet comes with headers that contain information concerning packet delivery and whatnot. The IP header has the source and destination IP address for the packet, which is used to get the packet across the internet. On the other hand the layer 2 frame header (ethernet or whatever) has the MAC address of the source (which would be the original host at this point) and the MAC address of the next router the packet is to be sent to (using ARP). The IP packet is left alone but with each hop the frame header is rewritten with a new source (the router's) MAC address and a new destination (the next hop). This is repeated within the network until a gateway within that network is reached, where the packet is then forwarded onto the ISP/provider's network. The same thing happens within the ISP/provider's network, with the packet (frame) being sent over the datalink layer while using the IP header for ARP. EGPs like BGP are used across networks, and IGPs are used within networks. And while IP addresses indicate the final destination, even over the internet MAC addresses are used to transport the data from router to router.

This makes sense to me because the internet is physically connected and MAC addresses are king when it comes to physical connections. But after being told I was wrong I've kinda lost confidence and now I'm just confusing myself. Is a different protocol or method used when data is sent from within the local network into the internet? Are MAC addresses only relevant within a network? Any help clearing this up for me is greatly appreciated. Thanks!

Answer 1

You need to look at the layers as each having its own mission.

The network layer is - as you wrote - end-to-end. Its addresses have global meaning (within the scope of the entire network). Accordingly, a network layer packet has a source and a destination address that don't change. NAT messes this up, but that can be seen as a translation layer or context change.

However, the network layer's mission is to make the packet routable along the hops across the network. It doesn't actually move the data. Instead, it uses the data link layer to get the data from one node to another within the current segment.

The data link layer's task is to move data (frames) across the local segment - or from the global perspective, hop-to-hop. The segment can hold a fairly large number of nodes, so you need a way to distinguish or address them - that's where MAC addresses come into play (for Ethernet and other MAC-based segments). The network layer packet is encapsulated in a data link layer frame, addressed to the next hop's "hardware" address (local to the segment) and sent over. Note that the hardware/MAC address is only meaningful within the scope of its segment.

For completeness, the data link layer doesn't actually move data either. Instead, it uses the physical layer to move the bits of the frame from one place to another, one link at a time (so you might say the physical layer is link-to-link).

Which one of the potentially many physical layer links is used (on a switch) is controlled by the data link layer (switching) - on a switch, the destination MAC address is used to select the port forwarding from. For this, the switch queries its MAC table (also source address table SAT, or content-addressable memory CAM). (In original Ethernet with multi-point connects or repeaters, the frame was forwarded to all nodes and simply ignored by all of them but the one addressed.)

At the end of the segment, the packet is extracted from the frame and forwarded across the next segment to the next hop. Which segment is used beyond that hop is controlled by the network layer's routing, ie. the current hop's/router's/gateway's routing table.

At the end, across all hops, the network packet is delivered to its destination address - voilà.

Answer 2

... as an afterword to the other fine answers ...

When we look at a packet travelling multiple hops across the internet, with the IP address "staying the same" and the MAC addresses "changing per hop", or think of the routers unwrapping an IP packet from the ethernet frame and then rewrapping it for the next segment, we are taking a birds-eye understanding the purpose of the whole enterprise.

But in an IP network, none of the machinery involved has this point of view. One of the fundamentals of the IP design is that every single packet has a routing decision made at every single hop, and these decisions are completely independent of it each other.

Thus, when a packet arrives at a router on some ethernet interface, the actions are:

• Receive frame
• Extract packet
• Decide what to do:
  • Discard packet, or
  • Consume packet, or
  • Forward packet

This happens for every single packet on every single hop.

(Digressing for astonishing scale: Internet traffic is supposed to be around 150 petabyte/month, which is 150 x 10¹⁵, at an illustrative 1000 bytes/packet and 5 hops/packet, would be about 285 Mevent/sec.)

The detail is more elaborate.

(Confining my description to a packet arriving and leaving on ethernet interfaces.)

1. The interface hardware checks the integrity of the frame (ethernet FCS, for example) and discards it if wrong
2. The interface hardware checks the destination MAC address, and discards the frame if not for this MAC address
3. It checks the content type and discards the frame if its a type this router doesn't handle
4. Assuming it's an IP payload
5. It unwraps the payload IP packet
6. It checks the header checksum and discards if error
7. It checks the destination IP address and if for this router consumes it locally
8. Assuming for some other host (and TTL > 1)
9. Checks routing table
10. Assuming it's for another network connected by an ethernet interface
11. Makes appropriate change (decrement TTL, fragment, recompute header checksums)
12. Finds target MAC address from routing table/cache/ARP
13. Wraps IP packet in ethernet frame and transmits

At step 2, the incoming frame's destination MAC address was the MAC address of the incoming interface; at step 13 the outgoing frame has the router's outgoing interface MAC address for source, and the next hop router's MAC address as destination.

Of course, the operating system of the router is likely to add various security checks, logging and accounting along the way.

Answer 3

MAC addresses are only seen or relevant on the LAN where the host with that MAC address is. Routers strip off and discard layer-2 frames, losing any layer-2 information, including MAC addresses.

Remember that not all layer-2 protocols use MAC addresses, and there are 48-bit and 64-bit MAC addresses, depending on the IEEE LAN protocol used (it is the IEEE LAN protocols that use MAC addresses). Other layer-2 protocols, especially those used for WAN connections, may not use MAC addresses. For example frame relay uses DLCI, ATM uses VPI/VCI, PPP and HDLC do not really use addressing, etc.

Layer-3 protocols, like IP, are used to deliver packets between networks (an internet, hence the name: Internet Protocol), but layer-2 protocols are used to deliver frames on the same network.