PACKET FLOW VISUALIZER_
Watch a packet actually flow — gliding from a PC, across a switch, two routers and another switch, to a server and back, with the TTL ticking down and the headers changing at every hop. Hit PLAY, set the speed, and follow encapsulation, ARP and MAC learning live. Then switch to the ATTACKS tab to see ARP spoofing, MAC flooding, DHCP spoofing, VLAN hopping, a broadcast storm, a SYN flood and more — each with its CCNA fix — or DIAGNOSTICS for traceroute and NAT/PAT. The mental model Packet Tracer's simulation mode gives you, in your browser.
[ ▶ QUICK SUMMARY ]
When a host sends data to another network, it wraps the data in headers — encapsulation: application ▶ transport (TCP/UDP) ▶ network (IP) ▶ data link (Ethernet/MAC). Because the destination is on a different subnet, the frame's destination MAC is the default gateway, while the destination IP stays the final server. To learn the gateway's MAC the host sends an ARP broadcast ("who has 192.168.1.1?"). Each switch learns the source MAC and forwards by MAC; each router strips the Ethernet frame (decapsulation), reads the IP, looks up the route, decrements the TTL, and re-wraps the packet in a new frame for the next link. Step through it below.★ NEW TO NETWORKING? Use NEXT ▶ to go at your own pace. Click any dotted term in the play-by-play for a plain-English definition. The squares above the buttons are the whole journey — green is done, yellow is where you are, and you can click any square to jump.
ENCAPSULATION STACK
WHAT THE DEVICES KNOW
show mac address-table / show arp lookups, and How Enterprise Networks Move Traffic walks the same path in prose.