What changes in a packet as it passes through routers?
The IP source and destination stay the same (without NAT), but each router decrements the TTL by 1 and the Ethernet frame is rebuilt with new source and destination MAC addresses for the next link.
Explain it simply
A parcel moves from Delhi to Pune through several depots. The final address on the parcel never changes, but each leg has a new delivery slip saying which truck takes it to the next depot.
Example
Laptop (MAC L) -> Router1 -> Router2 -> Server (MAC S)
Hop 1 frame: src MAC L, dst MAC R1 | IP src A, dst B, TTL 64
Hop 2 frame: src MAC R1, dst MAC R2 | IP src A, dst B, TTL 63
Hop 3 frame: src MAC R2, dst MAC S | IP src A, dst B, TTL 62IP addresses are end to end. MAC addresses are hop to hop and only meaningful on one link. To rebuild the frame, each router looks up the next hop's IP and uses ARP to find its MAC.
The router also recalculates the IPv4 header checksum because TTL changed. If TTL hits 0, the router discards the packet and sends ICMP Time Exceeded to the source. NAT is the exception: it rewrites IP addresses and ports too.
What to say in the interview
"IP addresses stay constant end to end; MAC addresses change at every hop; TTL goes down by one. That is why layer 3 is end to end and layer 2 is local. NAT is the main case where IP addresses are also changed."
Common mistakes
- Thinking the destination MAC in the frame is the final server's MAC all the way.