Default gateway

Framenew on every linkCheckthe mask testRouterouting table

not built yet192.0.2.0 ≠ 203.0.113.0 → use the gatewayfrom 00:00:5e:00:53:0a → to ff:ff:ff:ff:ff:fffrom 00:00:5e:00:53:01 → to 00:00:5e:00:53:0afrom 00:00:5e:00:53:0a → to 00:00:5e:00:53:01203.0.113.0/24 → via 198.51.100.2from 00:00:5e:00:53:02 → to 00:00:5e:00:53:03203.0.113.0/24 → directly connectedfrom 00:00:5e:00:53:04 → to 00:00:5e:00:53:0bto 00:00:5e:00:53:0b: that's me, keep it

Packetsame end to endARPasks for a MAC

from 192.0.2.10 → to 203.0.113.10who has 192.0.2.1? tell 192.0.2.10192.0.2.1 is at 00:00:5e:00:53:01

TTL 64TTL 64 → 63TTL 63TTL 63 → 62TTL 62

White envelope: the IP packet, the same from end to endColoured tray: the Ethernet frame, new on every laneLanes: three networks, joined by two routersTTL −1: each router lowers the hop counterYour laptop (192.0.2.10) sends one packet to 203.0.113.10. A mask check (255.255.255.0) shows the server is on another network, so the packet goes to the default gateway 192.0.2.1; ARP finds the gateway's MAC address first. The white envelope is the IP packet and never changes. The coloured tray under it is the Ethernet frame: each router throws it away, looks up the destination in its routing table, lowers TTL by one and builds a new frame for the next lane. All addresses are documentation values: IPv4 from RFC 5737 and MAC addresses from RFC 7042 (00:00:5e:00:53:xx). ff:ff:ff:ff:ff:ff is the real Ethernet broadcast address.

On your laptop

Your laptop (192.0.2.10) wants to reach a server at 203.0.113.10. It writes both IP addresses on a packet and sets TTL, a hop counter, to 64.

Finding the gateway

Hop by hop

The headers, field by field

;; step 1/10 · build-packet · local
;; at your laptop
IPv4 packet (RFC 791)
  source       192.0.2.10
  destination  203.0.113.10
  TTL          64  (a common default)
  payload      a TCP segment
no Ethernet frame yet: the laptop must first decide where to send it

The routers already know their neighbours’ MAC addresses from earlier ARP exchanges, so the figure shows ARP only once. Here every LAN uses public addresses, so nothing rewrites the IPs. A home LAN with 192.168.x.x addresses also needs NAT at its router, which swaps the source address; that is a later lesson.