In our previous blog, we explored how packets flow between two directly connected computers. If you haven’t checked it out yet, make sure to do so! Please click here to check the blog.
Now, let’s take things one step further. What if we introduce a switch between the two computers? How does the traffic flow change? What role does the switch play?
Let’s deep dive into this scenario and break down the packet flow between two computers connected via a switch.
Here’s the simple network topology we’ll be using to understand the process:
In this setup, PC1 is connected to the switch on port e0, and PC2 is connected to port e1.
The switch in use is a Layer 2 switch, meaning there’s no routing or configuration required on the switch side. It simply forwards Ethernet frames based on MAC addresses.
Topology –
Please follow below Steps –
- First, I checked the IP and MAC addresses on both PCs. At this point, the MAC address table is empty, and default IPs are assigned. So, I went ahead and configured the IPs manually:
PC1 IP Address – 12.1.1.1/24
PC2 IP Address – 12.1.1.2/24
- After assigning the IPs, I checked the ARP tables on both machines — and as expected, they were empty. This confirms that PC1 has no knowledge of PC2’s MAC address yet.
- Next, I attempted to ping PC2 (12.1.1.2) from PC1. To your surprise, the ping was successful — even though PC1 didn’t initially know PC2’s MAC. So, how does this work at the packet level?
To answer that, I opened Wireshark and captured the packets during the ping test.
- In the snapshot below, you’ll notice there are 10 ICMP packets. Even though you only see 5 lines in the ping output, it actually involves 5 ICMP Echo Requests and 5 Echo Replies — making 10 packets in total.
- During each ICMP Echo Request, PC1 is asking PC2, “Are you alive? Can I reach you?” — and PC2 confirms by replying. But remember, PC1 didn’t initially know PC2’s MAC address.
- So how was PC1 able to ping PC2? Here’s the trick — before sending any ICMP packets, PC1 first sends an ARP Request to resolve the MAC address of 12.1.1.2. This is clearly visible in the Wireshark capture just before the ICMP sequence starts.
Let’s now focus on how the switch processes these packets:
Step 1: The switch receives the ARP Request from PC1. It stores PC1’s MAC address and sees that the destination MAC is a broadcast (FF:FF:FF:FF:FF:FF). So, it floods this packet to all ports — except the one where it came from.
Step 2: Since PC2 is connected to port e1 and has a matching IP (12.1.1.2), it responds with an ARP Reply containing its MAC address.
Step 3: The switch receives the reply and now learns PC2’s MAC address, associating it with port e1.
Step 4: The switch builds its MAC address table with PC1 and PC2 mapped to ports e0 and e1 respectively.
Step 5: The switch forwards PC2’s ARP Reply directly to PC1, using the now-known destination MAC and port info.
In the ARP Request sent by PC1, the destination MAC is FF:FF:FF:FF:FF:FF, indicating a broadcast. You can see this clearly in the packet capture below.
- Next comes the ARP Reply from PC2 to PC1. In this response, PC2 says: “Here’s my MAC address — I’m 12.1.1.2.” This allows PC1 to finalize its ARP table.
- With all the information in place — source/destination IPs and MACs — PC1 now builds an Ethernet frame and sends an ICMP Echo Request to PC2. This is visible in the ICMP packet shown below.
- Finally, PC2 replies with an ICMP Echo Reply, confirming that it’s reachable. Both PCs can now communicate freely, and the entire process between PC1 and PC2 is complete.
And that’s how packet flow works between two PCs connected via a switch — simple, yet fascinating!
Finally –
So now you’ve seen the entire journey of a packet — from one PC to another, through a switch, with all the behind-the-scenes protocols like ARP and ICMP playing their roles.
Pretty cool, right?
Next time someone — maybe even your interviewer — asks,
“Can you explain how a packet flows between two PCs?”
You won’t just answer…
You’ll nail it with confidence, breaking it down step by step — with ARP requests, MAC learning, ICMP ping, and even Wireshark traces to back it up.
And that’s the kind of clarity and depth that sets you apart as a real network engineer.