I'm an application developer working on getting a working knowledge of network engineering, so basically a newbie. I've been trying to figure out exactly when routers decapsulate frames into packets and encapsulate packets into frames. I found Does a router send frames or packets?, and I'm still having difficulty getting clear on just when packets get encapsulated and decapsulated during the process of sending them from a source to a destination.

Ron Maupin answers the question I linked in this way:

A router must strip off the layer-2 frame in order to get to the layer-3 packet. The router then routes the packet to the next interface toward the destination, based on the layer-3 destination address. At the next interface, it must build a new frame for the packet for the layer-2 protocol on the next interface, which could be a completely different layer-2 protocol than the one used on the first interface.

Based on the beginning of this answer, I'm seeing that a router strips off the layer-2 frame, and then routes the packet. That suggests that routers route packets rather than frames. But then the answer says "at the next interface, it must build a new frame for the packet," and I'm having trouble reconciling that statement with the beginning one.

As I understand the process, routers route to other routers until the one associated with the destination network node gets it and send it to that node. As such, I'm seeing the "next interface" in the answer is the next router on the route until the final hop, when the "next interface" is the destination node. If so, then that seems to be saying that routers wrap packets in frames before sending them to the next router on the way to the destination.

So, I'm still not entirely clear after reading Ron's answer whether routers send frames or "naked" packets out on the internet. It seems to me that it would be simpler to decapsulate any frames that are sent out on the internet, leave them as "naked" packets while they are being passed from router to router (presumably routers use IP to figure out where to send the packet, and as such don't need a frame to move it along), and then, when the packet hits the router that is connected to the destination, that router re-encapuslates the packet in the frame type consistent with whatever layer-2 protocol it uses.

Is that what's actually happening, or do routers have to encapsulate packets into frames before forwarding them to other routers, and as such have to know what type of frame each router that it can send to needs? (That doesn't seem very scalable to me.)

Edit: this is the sort of thing that's confusing me, from the Wikipedia article on the Data-Link layer:

The data link layer is concerned with local delivery of frames between nodes on the same level of the network. Data-link frames, as these protocol data units are called, do not cross the boundaries of a local area network. Inter-network routing and global addressing are higher-layer functions, allowing data-link protocols to focus on local delivery, addressing, and media arbitration.

This comes pretty close to asserting, with no room for interpretation, that L2 involvement is limited to LAN boundaries, and is not a part of sending packets out on the internet.

  • Possibly related answer: networkengineering.stackexchange.com/a/27836/3675
    – Eddie
    Apr 4, 2020 at 7:52
  • @Eddie Related I'm sure, but it appears more to address the relationship between layers 3 and 4 rather than 2 and 3.
    – BobRodes
    Apr 4, 2020 at 8:19
  • 1
    Actually, that was me, Ron, not Don. There will be some type of network connection between routers, and the packet must be encapsulated in a frame for that network between the routers. It may be PPP for a home xDSL router, HDLC, frame relay, ATM, or any other WAN protocol, or even ethernet now that we are getting metro ethernet connections, but there is some type of layer-2 connection from router to router, and the layer-3 packet needs to be encapsulated for that layer-2 protocols between the routers.
    – Ron Maupin
    Apr 4, 2020 at 13:55
  • @RonMaupin Dangit, I went to high school with a kid named Don Maupin, only time I've ever seen that last name, and I'm also mildly dyslexic. I tried to make sure I didn't get them backwards and failed. Sorry Ron.
    – BobRodes
    Apr 4, 2020 at 20:23
  • @RonMaupin Thank you for spelling this out. I just haven't been able to find it spelled out anywhere. Followup to this: I download a page from stackexchange. My request goes first to WiFi, then to Ethernet (my router), then over the coax cable from the cable company, then, presumably, to some sort of fiber optic backbone. Where might I get a general idea of the different L2 protocols in use at different points in a typical internet transaction?
    – BobRodes
    Apr 4, 2020 at 20:25

3 Answers 3


Below is a diagram of an IPv4 packet encapsulated within an Ethernet frame. The Ethernet (layer-2) portions are shaded blue. The IPv4 header (layer-3) is shaded red. The payload (above layer-3) is white.

An IP router needs to understand the layer-2 protocols used on each of its interfaces. For many routers, this is only Ethernet; but there are other layer-2 protocols. In the 1990s, layer-2 protocols such as Frame-Relay and ATM were very popular.

A router can function on the Internet, without understanding those legacy protocols, because the layer-2 portion of the packet (shaded blue) is replaced by each router that forwards the packet. The blue part can even be replaced with an entirely different structure for a different layer-2 protocol.

Ethernet-Encapsulated IPv4 Packet

As the packet is forwarded from its source, across the Internet, to its destination, the red part remains almost the same (with some caveats.) All IP routers handle the red part identically. That's what makes them all compatible with each-other, and with our PCs and other devices; they all know how to work with the red part of the packet, and they're not even aware that the packet might have passed through layer-2 protocols they're unfamiliar with. This abstraction is deliberate, and allows IP networks to be constructed atop various underlying protocols.

When does this happen

Your original question is about when, in the routing process, this happens. The answer is, the layer-2 header is the first thing examined about an arriving packet. Generally, for unicast traffic, if the Destination MAC Address of an Ethernet frame isn't a MAC address owned by the router, it can ignore that packet with no further processing.

When is a new layer-2 header constructed for forwarding the packet to the next router or host? That happens after a routing decision has been made. That routing process can be complex; see the below image for an example of how Linux's iptables system does it. But at the very end, the out step, that's when all information needed to assemble the new packet is known. The process of creating the new packet is sometimes called the L2 Rewrite process, because most of what it does is replace the layer-2 header.

Linux IPTables

  • 1
    Let me see if I have the basic idea. The router has a set of MAC addresses that it recognizes to be part of its local network (which could be a WAN or a LAN, depending on the type of router). So, when a frame comes to the router, it examines the destination MAC address, and if it isn't one that it recognizes, it ignores it. If it is, it reconstructs the frame based on the protocol for the destination MAC and sends it there. This process is repeated until the node with the destination MAC is also the node with the destination IP address (IPv4DestAddress in your first diagram). Is that about it?
    – BobRodes
    Apr 7, 2020 at 6:09
  • Yes, that's a pretty fair description of how unicast routing works. Apr 7, 2020 at 12:43
  • Thank you! Good enough for my purposes at present.
    – BobRodes
    Apr 7, 2020 at 18:05

Basically, you can't send raw or naked packets out of an interface.

Data units require framing for transport: marking the start and end of data, and directing that data chunk through the network, essentially.

So, a packet needs to be wrapped or encapsulated by a frame for L2 transport. That frame is used throughout the L2 network (e.g. across switches) but needs to be removed by an L3 entity (router) to recover the actual packet. When the packet is forwarded out another interface is needs to be encapsulated again, depending on that L2 network.

That mechanism allows you to combine a multitude of different and incompatible L2 protocols like Ethernet, Wi-Fi, VDSL, DOCSIS, LTE, or even serial ports into a larger L3 network.

A very similar thing happens between the data link and the physical layer. Within an L2 network, like Ethernet, it allows you to combine a range of different media and speeds. The very same frame may be encoded and decoded in 10BASE-T, 1000BASE-SX, 10GBASE-LR along its path.

The general idea is that each layer has a certain function but doesn't know/care much about the others. L3 does the routing across vast distances, but can't actually move data(!). L2 manages the flows in the local, limited-size network and does the actual packetizing - but it still can't physically move data. L1 knows very little about all that, but it's the one actually moving the bits around.

  • Thanks for your answer. Two things: can you explain what an "interface" is in this context? (Specifically, is a router an interface?) And, suppose I have an Ethernet LAN with a router R1 that handles internet traffic. I then have, say, a Token Ring LAN with a router R2 that handles its internet traffic. I send a packet from the Ethernet LAN to the Token Ring LAN. Does R1 decapsulate the Ethernet frame, then re-encapsulate it as a Token Ring frame, then send it to R2, or does R1 decapsulate the Ethernet frame and send the raw packet to R2, which then encapsulates the raw packet in a TR frame?
    – BobRodes
    Apr 4, 2020 at 8:18
  • 1
    An interface is anything that connects to a network. Most interfaces are physical but there are virtual interfaces as well. A router requires interfaces, usually at least two. Re R1/R2 routers: these routers need to connect some way, through a common link. When that is Token Ring then your first description is correct. The second description doesn't work since they cannot exchange raw packets.
    – Zac67
    Apr 4, 2020 at 8:36
  • Ok, so analogous to software interfaces. "A router requires interfaces" put me on to that. So I'll ask you what I also asked Ron Trunk. Does each router needs to know what L2 protocol every router in its routing table uses, and every time it forwards a packet to a router in its table, it has to wrap it in a frame of the protocol type used by that router?
    – BobRodes
    Apr 4, 2020 at 20:14
  • 1
    Does each router need to know what L2 protocol every router in its routing table uses? Yes. Any gateway in a routing table needs to be connected through a shared L2 network, so yes, they need to speak the same language. It's possible to bridge some of the gateways into an similar protocol (e.g. Ethernet to Wi-Fi) though but framing needs to be compatible or very close.
    – Zac67
    Apr 4, 2020 at 20:20

Routers route data from one network to another. So routers have physical connections (interfaces) to two or more networks. If you only have two networks, you only need one router.

So in your example, a router might have a connection on an Ethernet network and another connection on a Token ring network. Host H1 on the Ethernet network sends an IP packet to a host H2 on the token ring network. H1 forwards the IP packet, encapsulated in an Ethernet frame, to the router.

The router strips off the Ethernet frame, and based on the destination IP address, decides which interface to forward the packet out of (in this particular case, there's only one other interface, but a router can have several interfaces on different networks). Since the packet has to go to H2 on the token ring network, the router encapsulates the packet in a token ring frame and sends it to H2.

  • Ok, I'm getting this. What we're saying, then, is that each router needs to know what L2 protocol every router in its routing table uses, and every time it forwards a packet to a router in its table, it has to wrap it in a frame of the L2 protocol type used by that router?
    – BobRodes
    Apr 4, 2020 at 20:14
  • No. It only knows the L2 networks of the interfaces it’s connected to. The router doesn’t know if it’s forwarding to a host or another router.
    – Ron Trunk
    Apr 4, 2020 at 21:18
  • Your home router has two interfaces—your local LAN and whatever WAN connection you have. When your computer sends a packet to Stack exchange, your router discards the Ethernet (or WiFi) header and encapsulates the packet in the WAN L2 protocol.
    – Ron Trunk
    Apr 4, 2020 at 21:22
  • (To your first) Ok, but the "interfaces it's connected to" are specified in the routing table, aren't they? (To your second) Ok, makes sense. Thanks.
    – BobRodes
    Apr 4, 2020 at 21:46
  • That’s not all that’s in the routing table
    – Ron Trunk
    Apr 4, 2020 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.