Protocol behavior

Packet Flow Visualizer

Step through how traffic moves from a client to a website on another subnet, including DNS, ARP, switching, routing, and frame or packet changes at each stage.

Interactive and local

Learn the full packet-flow concepts

Use this visualizer interactively, then read the concept guide for DNS, ARP, inter-VLAN routing, and DHCP relay behavior.

Read How Packets Travel Through a Network

Scenario selector

Version 1 fully implements Client to Website on another subnet.

Active scenario: Client to Website on another subnet.

Step 1 User enters URL Client PC -> Client PC
IP Packet

Network diagram

Current step highlights the active devices and forwarding path.

Select a step to visualize packet or frame movement.

Step-by-step timeline

    Layer breakdown

    Expand a layer to inspect details for the current step.

    What changed at this hop?

    Select a step to inspect protocol behavior.

    Changed

      Stayed the same

        Definitions and tooltips

        Hover or focus terms for concise definitions.

        Hover a term to see its meaning.

        How packet flow works

        The browser initiates several protocol actions before useful application data can be delivered.

        A client resolves a name to an IP, determines whether the destination is local or remote, resolves a next-hop MAC, and then sends framed traffic that routers forward toward the target network.

        Same-VLAN communication

        Hosts in the same subnet and VLAN send directly to each other at Layer 2 after ARP resolution.

        When Host A and Host B are both in 192.168.10.0/24 on VLAN 10, the default gateway is not used. Host A learns Host B MAC by ARP, then sends unicast frames directly to Host B through the switch.

        Same subnet = send directly to the destination host MAC address.

        Inter-VLAN routing

        Different VLANs are separate Layer 2 broadcast domains and require Layer 3 forwarding between gateways.

        Host A in VLAN 10 sends to its default gateway. The Layer 3 device removes the incoming Ethernet header, routes on destination IP, decrements TTL, and builds a new Ethernet frame toward VLAN 20.

        Incoming frame at routed hop

        • Source MAC: Host A
        • Destination MAC: VLAN 10 gateway
        • VLAN: 10
        • TTL: 64

        Outgoing frame at routed hop

        • Source MAC: VLAN 20 gateway
        • Destination MAC: Host B
        • VLAN: 20
        • TTL: 63

        Unchanged: Source IP, destination IP, and transport ports.

        DHCP DORA process

        DHCP Discover, Offer, Request, and Ack provide client addressing and policy options.

        A new client often starts from 0.0.0.0 and sends DHCP Discover using UDP 68 to UDP 67 with Layer 2 and Layer 3 broadcast destinations. The server response includes address, mask, gateway, DNS, and lease metadata.

        DHCP relay behavior

        Broadcast DHCP traffic does not cross routers unchanged, so relay agents forward requests toward remote servers.

        The relay receives client broadcasts on the local VLAN, adds relay context (giaddr), and forwards unicast DHCP messages to the remote server. Responses return through the relay and are delivered back into the client VLAN.

        DNS before traffic delivery

        DNS translates the URL into an IP address that the network stack can route.

        Without DNS resolution, the client cannot determine the destination IP and cannot build a valid Layer 3 packet for the web request.

        Why ARP is needed

        ARP maps a Layer 3 next hop to a Layer 2 destination address on Ethernet segments.

        The client does not send frames to a remote server MAC directly. It sends to the default gateway MAC when the destination is outside the local subnet.

        Switching vs routing

        Switches forward frames by MAC and VLAN, while routers forward packets by IP prefixes.

        Layer 2 switching

        The switch keeps the original IP packet but forwards the Ethernet frame based on destination MAC and VLAN context.

        Layer 3 routing

        The router removes Layer 2 headers, decrements TTL, chooses an egress route, and applies a new Layer 2 header for the next hop.

        What changes at every hop

        Layer 2 information usually changes per hop, while Layer 3 source and destination addresses usually remain end to end.

        Why MAC addresses change at routed hops

        Routers terminate one Layer 2 segment and originate a new Layer 2 frame on egress.

        The routed device keeps the IP packet intent but rewrites the Ethernet source and destination MAC addresses for each new segment on the path.

        Why broadcasts do not cross routers

        Local broadcasts remain inside the VLAN broadcast domain.

        Broadcast Ethernet frames such as ARP and DHCP Discover are not routed as-is across Layer 3 boundaries. Inter-subnet delivery requires routing logic or dedicated relay behavior.

        Common misunderstandings

        A few repeated assumptions cause many packet flow mistakes in troubleshooting.

        FAQ

        Short answers to common packet flow questions.

        Why does MAC addressing change hop by hop?

        Each routed segment is a separate Layer 2 domain. Routers rebuild Ethernet headers for every outgoing interface.

        Does TTL decrease on switches?

        No. Switches forward Layer 2 frames. TTL is a Layer 3 field and is decremented by routing devices.

        Can traffic move without DNS?

        Yes, if the client already has the destination IP and can route to it. DNS is required only for name-to-IP resolution.

        Does a host ARP for remote destinations?

        No. For remote subnets, the host ARPs for the default gateway MAC, not the remote host MAC.

        Are all DHCP replies broadcast?

        Not always. Offer and Ack delivery can be broadcast or unicast depending on flags and implementation details.

        What does a DHCP relay add?

        The relay provides client-subnet context to a remote DHCP server and forwards requests and responses between VLAN and server network.

        Related PacketToolbox resources

        Use these tools and guides together during network design and troubleshooting.