Traffic Types and Encapsulation Flow
Key Takeaways
- Unicast, broadcast, multicast, and anycast describe one-to-one, one-to-all, one-to-subscribers, and one-to-nearest delivery.
- Broadcast is confined to a broadcast domain and does not cross routers by default; a DHCP relay forwards specific requests.
- Multicast (224.0.0.0/4) targets only subscribed receivers and uses IGMP to manage group membership.
- Encapsulation turns application data into segments, packets, frames, and bits; de-encapsulation reverses it.
- For remote traffic the frame's destination MAC is the gateway, but the packet's destination IP stays the final host (unless NAT changes it).
Traffic Delivery Types
Networks move traffic in four delivery patterns, and the pattern changes addressing, switching, routing, bandwidth use, and how far a fault spreads. The N10-009 blueprint lists all four under Networking Concepts.
| Type | Pattern | Examples | Boundary behavior |
|---|---|---|---|
| Unicast | One sender to one receiver | Web, SSH, file transfer | Routed normally between networks |
| Broadcast | One sender to all hosts in a domain | ARP request, DHCP discover | Stops at the router, stays in the VLAN |
| Multicast | One sender to subscribed receivers | Streaming, OSPF, EIGRP, imaging | Needs IGMP and multicast-aware routing |
| Anycast | One address, served by the nearest node | Public DNS (e.g., 8.8.8.8), CDN | Routing picks the closest instance |
Broadcast uses the all-ones destination (255.255.255.255 or MAC ff:ff:ff:ff:ff:ff). Multicast uses the 224.0.0.0/4 IPv4 range and relies on IGMP (Internet Group Management Protocol) so switches and routers only forward streams to ports with interested subscribers. IPv6 drops broadcast entirely and uses multicast instead, which is why ARP (a broadcast protocol) is replaced by Neighbor Discovery in IPv6.
The practical reason these distinctions matter is bandwidth and fault scope. A unicast video stream to 100 viewers sends 100 copies and saturates the source link, whereas a single multicast stream sends one copy that the network replicates only where subscribers exist, which is why live streaming, IP television, and ghost/imaging deployments rely on it. Broadcast is the bluntest pattern: every host must process the frame up to at least Layer 2, so a broadcast storm, a runaway loop flooding broadcasts, can paralyze an entire flat network and is a classic argument for segmenting with VLANs.
Anycast is subtler: many geographically separate servers share one IP, and routing simply delivers each client to the nearest instance, giving public DNS resolvers like 8.8.8.8 and content delivery networks their resilience and low latency.
Broadcast Domains and VLANs
A VLAN is one Layer 2 broadcast domain. Hosts in the same VLAN hear each other's broadcasts; hosts in different VLANs need a Layer 3 device (router or Layer 3 switch) for inter-VLAN routing.
| Design | Broadcast impact |
|---|---|
| One flat LAN | Broadcasts reach every host; a storm hits everyone |
| Multiple VLANs | Each broadcast is contained per VLAN |
| Router / L3 switch between VLANs | Routes unicast, blocks ordinary broadcast |
| DHCP relay (IP helper) | Forwards specific DHCP broadcasts across the boundary |
Encapsulation Flow, Step by Step
When a client opens an HTTPS site, the data is wrapped layer by layer for transit. Each layer adds its own header (Layer 2 also adds a trailer, the FCS).
| Step | Action | Information added |
|---|---|---|
| 1 | Application creates data | HTTP request inside a TLS session |
| 2 | Transport adds TCP header | Source port, destination port 443, sequence numbers |
| 3 | Network adds IP header | Source IP, destination IP, TTL |
| 4 | Data link adds frame header + trailer | Source MAC, destination MAC, FCS |
| 5 | Physical transmits | Electrical, optical, or radio symbols |
The receiver reverses this (de-encapsulation): each layer reads its header, validates (for example, checks the FCS), and passes the payload up.
Local vs. Remote Delivery (High Yield)
This distinction trips up many candidates. The Layer 2 frame is rewritten at every hop, but the Layer 3 packet's destination IP stays the final host unless NAT rewrites it.
| Destination | Destination MAC in frame | Destination IP in packet |
|---|---|---|
| Same subnet | The receiver's own MAC | The receiver's IP |
| Different subnet | The default gateway's MAC | The final host's IP |
Worked Scenario: ARP and Remote Traffic
A client at 192.168.10.25 wants to reach a server at 192.168.50.20. It compares the destination to its subnet mask, sees the server is remote, and uses ARP to learn the default gateway's MAC. It sends the frame to the gateway MAC, but the IP packet still names 192.168.50.20. The router strips the incoming frame, checks the packet, chooses a route, and builds a brand-new frame for the next hop, repeating until delivery.
Common Exam Traps
| Trap | Correct reasoning |
|---|---|
| Broadcasts cross routers automatically | Routers stop broadcasts; relays forward specific requests |
| MACs identify hosts end to end | MACs are local to each Layer 2 segment and change per hop |
| Multicast equals broadcast | Multicast reaches only subscribed receivers via IGMP |
| NAT rewrites every header | NAT rewrites addressing as configured, not the whole stack |
| A VLAN is a Layer 3 subnet by itself | A VLAN is Layer 2, usually paired with one IP subnet |
Traffic type plus encapsulation explains why a host with a perfectly correct IP can still fail because of ARP, VLAN, gateway, ACL, NAT, or routing behavior.
Tie the concepts together with one mental model: the IP packet is the end-to-end "envelope" that survives the whole journey, while each frame is a "local courier" that exists only for one hop. At every router the courier is discarded and a new one created for the next segment, but the envelope's source and destination IPs stay constant. NAT is the one common exception, it rewrites the source IP (and often the source port) as traffic leaves a private network so return traffic can find its way back, and Port Address Translation lets an entire LAN share one public IP by tracking the unique source-port-to-internal-host mapping.
Layering this on top of the delivery types completes the picture the exam tests: knowing whether traffic is unicast, broadcast, or multicast tells you how far it spreads, while knowing the encapsulation flow tells you which header to inspect when it breaks. Together they let you reason from a symptom, "I can ping by IP but not by name," or "two VLANs cannot talk," straight to the responsible layer and the right tool.
A video server streams one feed that should reach only the dozen workstations that requested it, without flooding every host on the subnet. Which delivery type and helper protocol apply?
A host at 10.1.10.5 sends a packet to a server at 10.1.50.9 on a different subnet. What does the host place in the frame's destination MAC and the packet's destination IP?
Order the encapsulation steps for a client sending HTTPS traffic, from top of the stack downward.
Arrange the items in the correct order
Which statements about traffic and encapsulation are correct? Select all that apply.
Select all that apply