What happens when a user enters a website URL
- Client resolves the domain name with DNS.
- Client decides local subnet or remote destination using local mask/prefix.
- If remote, client ARPs for the default gateway MAC.
- Client encapsulates IP packet in an Ethernet frame and sends it.
- Routers decapsulate, route lookup, decrement TTL, and re-encapsulate per hop.
Source and destination IPs typically stay end-to-end. Source and destination MAC addresses change per Layer 2 segment.
Packet versus frame and encapsulation
| Term | Layer | Key fields |
|---|---|---|
| Packet | Layer 3 | Source IP, destination IP, TTL |
| Frame | Layer 2 | Source MAC, destination MAC, VLAN context |
Switches forward frames. Routers forward packets and rebuild frames for the next segment.
Scenario 1: Client to Website
In the Packet Flow Visualizer, this scenario shows DNS lookup, ARP for gateway, and routed forwarding toward the web server network.
- DNS happens before the client can build destination IP traffic from a URL.
- If destination is remote, client sends to gateway MAC, not server MAC.
- Each router hop decrements TTL and rewrites Layer 2 headers.
Scenario 2: Same VLAN Host to Host
When two hosts are in the same subnet and VLAN, traffic stays Layer 2 local after ARP resolution.
- Host A ARPs for Host B MAC.
- Switch forwards based on MAC table lookup.
- Default gateway is not used for this path.
Scenario 3: Inter-VLAN Routing
For different VLANs, traffic must hit a Layer 3 gateway.
- Source host sends frame to gateway MAC in source VLAN.
- Router decapsulates, performs route lookup, decrements TTL.
- Router resolves destination-side next-hop MAC and sends a new frame in destination VLAN.
Scenario 4: DHCP Process (DORA) and DHCP relay
DHCP sequence is Discover, Offer, Request, Ack.
Same-VLAN DHCP server
- Client Discover starts from 0.0.0.0 to broadcast destination.
- Server Offer provides candidate lease and options.
- Client Request asks for one offered lease.
- Server Ack confirms final assignment.
Relay case (server on another subnet)
Broadcast messages do not route unchanged across Layer 3 boundaries. Relay agent forwards requests to the remote server and returns replies to the client segment.
NAT as a separate concept
NAT can alter source or destination IP information when configured, but NAT is not inherent to basic forwarding. Packet forwarding fundamentals still apply with or without NAT.
Troubleshooting packet flow
- Check host IP/mask/gateway correctness.
- Verify DNS resolution for URL-based failures.
- Validate ARP table and gateway reachability.
- Confirm VLAN membership and switch MAC learning.
- Inspect route table and next-hop resolution.
- Check DHCP lease status and relay path where relevant.
Common misconceptions
- A host ARPs for a remote server MAC address. It does not; it ARPs for gateway MAC.
- Routers change source/destination IP on every hop. Normally they do not.
- Switches decrement TTL. They do not; routers do.
- DNS is optional when users type URLs. Name-to-IP resolution is required unless IP is entered directly.
FAQ
Why does the destination MAC change while destination IP stays the same?
MAC addressing is local to each Layer 2 segment; IP destination expresses end-to-end destination intent.
Can same-VLAN hosts communicate without a router?
Yes, provided they are in the same IP subnet and VLAN and can resolve each other by ARP.
Does DHCP always require a relay?
No. Relay is needed when client and server are on different Layer 3 segments.
Use Packet Flow Visualizer, then continue to IPv4 Subnetting Explained.