In tunneling, a packet gets encapsulated in the payload section of another packet. If the router at one end encapsulates the packet, then how the router at another end identifies whether the packet is encapsulated or not.

Is there any ip header fields that helps a router to find out whether a packet is encapsulated or not?

  • It is handled in exactly the same way as any other protocols: HTTP, Bittorrent, FTP, ssh etc. The destination router does not know that there is a packet inside the encapsulating packet. All it knows is that there is a packet with DATA. That the data is another IP packet is confusing you. The router does not know that the data inside the packet is a packet. The receiving app (the tunnel client) is the only one that knows that the data is a packet just like your web browser is the only one that knows that the data is HTTP
    – slebetman
    Sep 17, 2021 at 0:13

2 Answers 2


Encapsulation requires a protocol. Depending on the protocol, an encapsulating packet is uniquely identified by either EtherType (in layer 2), IP protocol number (in layer 3), transport-layer port number (in layer 4), enabling the gateway to handle the packet as required.

The gateway commonly uses additional information from the encapsulating or underlying layers (MAC address, source IP address, source port, ...) to identify the tunneling partner as well. (Of course, it'll also use the destination addresses, whether it is the destination itself. Other destinations may need forwarding or some other kind of processing.)

In essence, a tunneling protocol uses the underlying layers in exactly the same way as any other protocol. The only difference is that the payload is a tunneled packet (plus metadata where required).

  • I don't get the second paragraph - 'The gateway commonly uses additional information from the same.... ' . Could you explain that plz.
    – Allan
    Sep 16, 2021 at 12:15
  • @Allan I included the examples to make this clearer. Layer-2 encapsulation primarily uses EtherType but may also use the source (and destination) MAC address, layer-3 encapsulation primarily uses the protocol number and likely the source/destination IP address, and so on.
    – Zac67
    Sep 16, 2021 at 13:21

I can't say that this applies to every tunnel imaginable, but this is a general idea how this could work.

A tunnel is set up between an entry point and an exit point. In this case the outer packet will have entry point as a source address and exit point as a destination address. The exit point will receive a packet with itself as a destination address. Thus the exit point knows that it doesn't have to forward packet, but instead needs to process it.

After the exit point has determined that it is responsible for packet processing, it needs to know what to do with the packet. Usually, the next thing to do is to determine what the next header is and parse it[*]. In IP (that is if the outer header is IP), what the next header is, is specified in protocol field (IPv4) or next header field (IPv6). For example, if the inner header is IP then the protocol field is set to 4. Other tunneling protocols will have different values.

So, in the example of IP in IP, the router can determine that it has received an IP packet destined to itself which contains another IP packet inside it. Then the router does what is written in the tunneling protocol specification.

[*] This is actually what every system does when it receives a packet with itself as a destination address. It checks the protocol/next header field to determine what further processing the packet needs.

Note: tunnel does not have to be "over IP", there are tunnels over L2, L3, or L4 protocols. The general principle is the same, outer header has to have some field identifying inner header. L2 and L3 protocols usually have an equivalent of "next header" field, e.g., Ethertype in Ethernet. L4 protocols differentiate data flows by ports.

  • Don't forget that you can tunnel over layer 2 or layer 4 as well. ;-)
    – Zac67
    Sep 16, 2021 at 11:12
  • @Zac67 what would be an example of layer 2 tunneling protocol?
    – Effie
    Sep 16, 2021 at 11:41
  • 1
    @effenok QinQ, EoMPLS, pseudowires.
    – Ron Trunk
    Sep 16, 2021 at 12:07
  • 1
    @effenok I'd even include PPPoE and PPPoA (L2 over L2) but that depends on perspective.
    – Zac67
    Sep 16, 2021 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.