How Data Moves: MAC and IP, Frames and Packets, Switches and Routers, and the Layers in Plain Terms
Unit 2: Networking Fundamentals. Lesson 5 of 41 in APlus Academy Core 1.
Before memorizing ports and cables, get the mental picture right. Every network question on Core 1 is easier once you can trace a piece of data from one computer to another.
Two addresses on every device
- The MAC address is burned into the network interface: 48 bits written as six pairs of hex digits, such as 3C-52-82-1A-9F-04. The first three pairs identify the manufacturer. It only matters on the local network.
- The IP address is assigned by you or by DHCP: 192.168.1.20 with a subnet mask. It is logical, can change, and is what routers use to move data between networks.
A device that knows a neighbor's IP address but needs its MAC asks with ARP (address resolution protocol): "who has 192.168.1.1?" and the owner answers with its MAC.
Frames and packets
Data is wrapped in layers like an envelope inside an envelope. The application writes a message; TCP or UDP adds port numbers; IP adds the source and destination IP addresses to make a packet; Ethernet or Wi-Fi adds the source and destination MAC addresses to make a frame and puts it on the wire. Each device along the way opens only the layer it cares about.
Switches and routers
- A switch connects devices on one network. It learns which MAC address is on which port by watching traffic and forwards each frame only to the right port. It does not look at IP addresses.
- A router connects different networks. It reads the destination IP address and picks the next hop. Your computer sends anything not on its own network to the default gateway, which is the router's address on your network.
- A hub was a dumb repeater that sent every frame everywhere; switches replaced it.
The layers in plain terms
Textbooks describe seven OSI layers; a technician needs five ideas:
- Physical: cables, connectors, radio signals, link lights.
- Data link: MAC addresses, frames, switches, Wi-Fi association.
- Network: IP addresses, packets, routers, the gateway.
- Transport: TCP and UDP, port numbers.
- Application: HTTP, DNS, SMB, and the rest.
Troubleshooting runs bottom up: link light, then IP address, then can you reach the gateway, then can you resolve names, then does the application work.
One web request, start to finish
The laptop asks DNS for the address of the site. It sees the answer is not on its own subnet, ARPs for the gateway's MAC, and hands the switch a frame addressed to the router's MAC carrying a packet addressed to the web server's IP. The router translates the private address to its public one (NAT) and forwards it toward the internet. The reply retraces the path.
How Data Moves: MAC and IP, Frames and Packets, Switches and Routers, and the Layers in Plain Terms, explained slowly
Why an analogy helps here
A network is a postal system with two kinds of addresses. The MAC address is the name printed on the mailbox at the end of your driveway: fixed, physical, only useful on your street. The IP address is the postal address: it says which city and street you are on, so the post office can route a letter across the country. The switch is the mail carrier who walks your street and knows which mailbox belongs to whom. The router is the sorting office that reads the city and forwards the letter toward it.
The two addresses
MAC address IP address
size 48 bits 32 bits (IPv4) or 128 bits (IPv6)
written as 6 hex pairs: 3C-52-82-1A-9F-04 4 decimal octets: 192.168.1.20
assigned by the manufacturer (first 3 pairs you or DHCP
identify the maker)
changes no (can be spoofed) yes, when the device moves networks
used by switches, within one network routers, between networks
found with ipconfig /all (physical address) ipconfig (IPv4 address)ARP is the lookup between them. A device that wants to send to 192.168.1.1 broadcasts "who has 192.168.1.1?" and the owner replies with its MAC. The answer is cached for a few minutes.
Envelopes inside envelopes
[ Ethernet frame: src MAC, dst MAC
[ IP packet: src IP, dst IP
[ TCP or UDP segment: src port, dst port
[ application data: an HTTP request, a DNS query ] ] ] ]Each device opens only its own envelope. A switch reads the frame's MAC addresses and forwards; it never opens the packet. A router strips the frame, reads the packet's IP addresses, decides where to send it, and wraps it in a new frame addressed to the next hop's MAC. The destination computer opens all of them and hands the data to the right program by port number.
A walk across the network
Your laptop (192.168.1.20, gateway 192.168.1.1) loads a website whose address is 203.0.113.10.
- The laptop compares 203.0.113.10 with its own network using the mask. Different network, so the packet must go to the gateway.
- It ARPs for 192.168.1.1 and learns the router's MAC.
- It builds a frame: destination MAC = router, containing a packet: destination IP = 203.0.113.10.
- The switch sees the router's MAC and forwards the frame out the router's port only.
- The router opens the frame, reads the packet, replaces the private source address with its public one (NAT), and sends it to the ISP.
- The web server's reply comes back to the router's public address; NAT maps it back to 192.168.1.20 and the router builds a frame for the laptop's MAC.
Every troubleshooting question about "can reach local devices but not the internet" is a break at step 1, 2, or 5: a wrong mask, a wrong or missing gateway, or a router problem.
Layers as a checklist
layer (plain name) things to check typical symptom physical cable, connector, link light, radio no link light, "cable unplugged" data link MAC, switch port, VLAN, Wi-Fi association link but no address, wrong VLAN network IP, mask, gateway, router APIPA address, cannot reach gateway transport TCP/UDP, port, firewall service blocked, connection refused application DNS, HTTP, the program itself addresses work, names do not
Work up from the bottom. A link light saves ten minutes of DNS speculation.
How the exam asks it
- "Which address does a switch use to forward a frame?" The MAC address.
- "A PC can ping neighbors but nothing on the internet. Most likely?" Wrong or missing default gateway.
- "Which device separates two networks and forwards by IP address?" A router.
- "What identifies the manufacturer of a network card?" The first three octets of the MAC address.
What to memorize
- MAC 48 bits, hex, burned in, local. IP logical, routed, from DHCP or typed in.
- ARP: IP to MAC. Frame carries packet carries segment carries data.
- Switch by MAC within a network; router by IP between networks; gateway is the router.
- Troubleshoot physical, data link, network, transport, application, in that order.