A packet crosses three routers. What changes in it at each hop, and what stays the same?
Show the answer
Say this first
The layer 2 header is rebuilt at every hop: new source MAC (the router's outgoing interface) and new destination MAC (the next hop, learned through ARP). The source and destination IP addresses stay the same end to end unless NAT is involved. Each router decrements TTL by one, recalculates the IPv4 header checksum, and a new FCS is computed for the new frame.
Go deeper
Per hop, on each router
- Check the FCS of the incoming frame. Drop it if it is bad.
- Strip the Ethernet header and trailer.
- Check the IPv4 header checksum, decrement TTL. If TTL reaches 0, drop the packet and send ICMP Time Exceeded (type 11, code 0) to the source.
- Look up the destination in the routing table (longest prefix match) to get the next hop and outgoing interface.
- Resolve the next hop's MAC address (ARP cache, or ARP request).
- Recalculate the IPv4 header checksum (TTL changed), build a new frame, compute a new FCS, send it.
What else can change
- NAT at the edge rewrites source IP and often source port.
- Fragmentation: if the outgoing MTU is smaller and DF is clear, IPv4 routers split the packet.
- DSCP may be re-marked by QoS policy.
- VLAN tags are added, removed or changed per link.
What stays the same
Source and destination IP (without NAT), the TCP or UDP header and the payload.
They will ask next
Why does the router need to recalculate the IP checksum?
The IPv4 header checksum covers the header only, and TTL is in the header. Every TTL decrement changes the checksum. IPv6 removed the header checksum partly to avoid this per-hop work.
If you capture on the link before the last router, what destination MAC do you see?
The last router's MAC on that link, not the server's. The server's MAC only appears on the server's own segment.
Traps
- Saying the destination MAC is the final server's MAC all the way. MACs are only meaningful on one link.
- Forgetting TTL and checksum change at every hop.