Watch first

Also watch — playlist supplement

Plain-English explanation

When PC A sends data to PC B, nothing travels as a single blob. The application hands bytes to a transport protocol (TCP or UDP), which adds port numbers. IP wraps that in a packet with source and destination IP addresses. Ethernet then wraps the packet in a frame with source and destination MAC addresses.

On the same subnet, the frame goes directly to B's MAC after ARP resolves it. On a different subnet, A still puts B's IP in the packet, but the frame is addressed to the default gateway's MAC. The router strips the old frame, reads the IP destination, and forwards — creating a new frame on the next hop.

Deep dive

Think of two address systems working together:

• IP (Layer 3) — logical, end-to-end, survives routing hops
• MAC (Layer 2) — physical on the local segment, changes every L2 hop

Each router hop is a new encapsulation story: decapsulate frame → inspect IP → route lookup → encapsulate new frame with the next-hop MAC.

Key PDU names CCNA expects:

| Layer | PDU name | |-------|----------| | Transport | Segment (TCP) or Datagram (UDP) | | Network | Packet | | Data Link | Frame |

Step-by-step — ping across a gateway

PC A: 192.168.1.10/24, gateway 192.168.1.1, target PC B: 10.0.0.50/24

1. A compares B's IP to its own mask — different network → use default gateway
2. A ARPs for 192.168.1.1 (if not cached) to learn the gateway MAC
3. A builds ICMP inside IP (src 192.168.1.10, dst 10.0.0.50), frames it to gateway MAC
4. Router receives frame, strips L2, decrements TTL, routes toward 10.0.0.0/24
5. Router ARPs on the outbound interface, builds new frame toward B (or next router)
6. B replies — same process in reverse; source IP stays A, source MAC changes per hop

Commands to know

Windows
arp -a
route print
Linux/macOS
arp -n
ip route

show ip arp
show ip route
show interfaces status

Troubleshooting

| Symptom | Likely layer | First check | |---------|--------------|-------------| | No connectivity at all | L1/L2 | Link lights, show interfaces status | | IP works locally, not remotely | L3 | Default gateway, show ip route | | Ping to gateway fails | L2/L3 | ARP table, VLAN, mask | | Ping works, app fails | L4/L7 | Port/firewall, DNS, TCP vs UDP |

Always ask: where did the packet stop? If ARP fails, IP never gets a fair test. If routing is wrong, the packet dies at the first router.

Exam relevance

Practice checklist

• Draw a two-PC same-subnet exchange and label segment, packet, and frame
• Draw a cross-subnet ping and mark where ARP targets the gateway, not the remote host
• List which headers change at each router hop (IP TTL, MAC src/dst)
• Use the packet walk tool to trace one scenario aloud without notes
• Explain why switches do not rewrite IP addresses