← Back

The Life of a Packet: From Application to Routing

By Shay Mordechai | December 18, 2025

Deconstructing the network stack: HTTP relies on TCP for stateful tracking, while DNS uses UDP for stateless resolution. Encapsulation works outwards: Application data (L7) → TLS (L6) → TCP Ports (L4) → IP Addresses (L3) → MAC Addresses via ARP (L2)[cite: 18].

When the packet hits the Default Gateway, NAT translates the internal IP, while PAT translates the source port. Along the BGP-routed internet, L2 MAC frames are constantly stripped and rewritten[cite: 18].

ARP Spoofing Threat Model: In isolated Container Namespaces routing to Linux Bridges, an attacker compromising a container can broadcast forged ARP replies, poisoning routing tables in the SDN to intercept intra-LAN traffic[cite: 18].