Suppose in application layer is running some application. And application has respective source port number and destination port number. And know that n layer has no authentication to know about n+1 level payload.

But we see in TCP or UDP header has source and destination application port number. Ipv4 header protocol field has transport layer protocol number and in Ipv6 extension header. Similarly, Ethernet header has Ethertype field has layer3 protocol information.

My question is how layer n come to know which port/protocol running at n+1 level despite without knowing n+1 level payload?

1 Answer 1


The headers of the protocols have fields to tell each protocol where to send its payload.

For example, ethernet has the EtherType field. If ethernet receives a frame with an EtherType field value of 0x0800, ethernet will send its payload to the address of the process corresponding to the EtherType value, which is IPv4 for that value.

IPv4 has the Protocol header field (IPv6 Next Header) that functions the same way.

Some transport protocols have ports that perform the same function.

The OS will maintain the tables so that the protocols have a place to look up to see if there is a valid value in the field, and know where to send any payload for a specific value (or drop the payload for invalid values in that host).

When IP gets a packet with a protocol number of 17, it will look in the table to see if a transport protocol is registered with that number, and if there is one (UDP), then it can get from the table where to send the payload for that packet. If UDP has not been installed in the OS, then IP drops the payload, possibly sending an ICMP error back to the source.

  • 1
    DNS stores the URI and IP address relationship as data.. How the application then sends to that address is up to the OS. You have been getting deeper into what and how an OS does, and that can vary wildly between different OSes. We cannot answer how an OS does what it does. That may be answered on one of the OS-specific SE site, or maybe on Stack Overflow. Every OS has a set of APIs to deal with networking, and how Windows works is different than Linux, which is different than MacOS, etc. There is no single answer.
    – Ron Maupin
    Mar 12, 2022 at 16:26
  • 1
    Look at the definition of the IPv6 header. It is greatly simplified from the IPv4 header. It needs to be an even number of 32-bit words, and there were various things people wanted to include in the header as it was being designed. There were 20 bits left over when the basic header fields were put in, and there was competition on what to do with those bits. It was decided to create the flow label that was poorly understood and supported. It is not for IPv6 itself, but for other applications to use with IPv6. Unused, it is 0.
    – Ron Maupin
    Mar 12, 2022 at 18:18
  • 1
    All the fields required to be in the IPv6 header (Version, Traffic Class, Payload Length Next Header, Hop Limit, Source Address, Destination Address) total 300 bits, but that is not an even number of 32-bit words, so there were 20 bits left over, and they were called the Flow Label. There are proposals out there to use the flow label for various other things, e.g. to defend against spoofing attacks. It is poorly supported with no actual standard for what should be in it.
    – Ron Maupin
    Mar 12, 2022 at 18:34
  • 1
    It is like the IPv4 DSCP or the IPv6 Traffic Class fields. IP, itself, does not use those fields, but other devices or applications may or may not use them. Early IPv6 RFCs would say something like: "The 24-bit Flow Label field in the IPv6 header may be used by a source to label those packets for which it requests special handling by the IPv6 routers, such as non-default quality of service or "real-time" service. This aspect of IPv6 is, at the time of writing, still experimental and subject to change as the requirements for flow support in the Internet become clearer."
    – Ron Maupin
    Mar 12, 2022 at 22:38
  • 1
    @AlokMaity, as you can see, the flow label was just a "junk" field made from leftover bits (originally 24 bits, but shortened to 20 bits when the Priority field was expanded from four bits to the eight-bit Traffic Class field) in the IPv6 header with no real goal in mind. People are starting to come up with various ideas of how it should be used by devices and applications, but IPv6 does not use that field in its header. For all we know now, that field may again be redefined in part or whole for something else altogether. You are trying to place undue importance on that field.
    – Ron Maupin
    Mar 12, 2022 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.