Packets & layers

Sending a web page across the internet is a big job, so it's split into layers. Each layer does one thing and trusts the layer below for the rest, like a letter going into an envelope, the envelope into a mailbag, the mailbag into a truck. This lesson is the map for the whole path: once you know the layers, you know where to look when something breaks.

The layers

There are two famous versions. The OSI model has 7 layers and is what people say ("that's a layer 7 problem"). The TCP/IP model has 4 and is what the internet actually runs. They line up like this:

The rest of this path goes up the stack: lesson 2 and lesson 3 are layer 3, lesson 5 is layer 4, and DNS, HTTP and TLS live at the top.

Encapsulation

On the way out, each layer wraps what it gets from the layer above in its own header:

Each router on the way takes off the Ethernet header, reads the IP header to decide where next, and wraps it in a new Ethernet header for the next hop. The IP addresses stay the same from end to end (NAT aside); the MAC addresses change at every hop. tcpdump -e shows you the outside of the envelope too.

MAC addresses, ARP, switches and routers

• A MAC address (like 08:00:27:4c:1a:7e) is burned into each network card. It only matters on the local network.
• To send to 192.168.1.80 on the same network, your machine needs its MAC. It shouts "who has 192.168.1.80?" to everyone (an ARP request) and the printer answers. The answers are kept in the neighbour table: ip neigh. (IPv6 does the same with "neighbour discovery".)
• For an address on another network, your machine only needs the router's MAC. The router handles the rest.
• A switch works at layer 2: it forwards frames by MAC address inside one network. A router works at layer 3: it moves packets between networks by IP address. Your home "router" is both, plus Wi-Fi, plus NAT.

MTU: how big a packet can be

Every link has a maximum transmission unit, normally 1500 bytes on Ethernet. Bigger packets have to be split (fragmented) or are refused. Tunnels and VPNs add their own headers, which makes the space left smaller. The classic symptom of an MTU problem is strange: small things work (ping, SSH login, small pages), but big transfers or some HTTPS sites hang. Test it with "don't fragment" pings:

ping -c 1 -M do -s 1472 192.168.1.1   # 1472 + 8 (ICMP) + 20 (IP) = 1500: fits
ping -c 1 -M do -s 1473 192.168.1.1   # 1501: too big

These layer tools work the same on both families. What's different is where you'd change the MTU permanently:

Try it: from the cable up 🧱

Start at the bottom of the club server's network stack and work your way up, one layer at a time.

Quick check