Trace a Packet Through Every Network Layer

Layered Models

Every network packet traverses a layered architecture before reaching the wire. The OSI model has seven layers; the TCP/IP model collapses them into four. For example, when you run ping 8.8.8.8, the ICMP echo request passes through application, network, link, and physical layers before the NIC transmits anything.

TCP/IP Layers in Practice

The TCP/IP model maps cleanly to real headers you will parse later:

• Link: Ethernet frame with destination MAC, source MAC, EtherType 0x0800
• Internet: IPv4 header with TTL (often 64), protocol field 1 for ICMP
• Transport: TCP or UDP segments with port numbers, or skipped for ICMP
• Application: HTTP, DNS, or in ping's case the ICMP type/code fields

Ping Packet Flow

Tracing a ping from application to wire:

1. Application: ping creates an ICMP echo request (type 8, code 0)
2. Socket layer: the OS opens a raw ICMP socket
3. Network: IP header prepended with src/dst addresses, TTL set, protocol 1
4. Link: Ethernet header with MAC addresses, EtherType 0x0800
5. Physical: frame encoded as electrical signals on the wire

Each layer adds its own header (encapsulation). The receiver strips headers in reverse order.

Why This Exercise

This task asks you to document each layer with printf statements for a ping packet. You will need this mental map when Wireshark shows you nested protocol trees and you must decide which layer owns a given field.