Same-Subnet Communication: Following One Packet

This is the simplest journey a packet can make, and it is the foundation for everything else in this unit: two computers, one switch and one subnet. Even so, eleven separate things must happen before PC-B receives anything. Once you can explain each one, the different-subnet journey is just the same story with a router added.

What “same-subnet communication” means

Same-subnet communication happens when a device sends traffic to another device whose IP address is in its own subnet. A subnet is a group of addresses that share the same network part, as defined by the subnet mask. Devices in the same subnet can reach each other directly through switches, without a router in the middle.

This kind of traffic is everywhere: a laptop printing to an office printer, a PC opening a file share on a local server, or a phone casting video to a TV on your home Wi-Fi.

💡 In simple terms: it is like handing a note to a colleague in the same room. You don't need the post office (the router). You only need to know which desk they sit at (their MAC address).

The lab: who is who

The same small network is used throughout this lesson. PC-A is going to ping PC-B. A ping is an ICMP Echo Request, but the steps are the same for any data: a web request, a file copy or a print job.

Where this happens in the network

Everything in this lesson stays inside one broadcast domain: the PCs, the cables and the switch. In OSI terms, PC-A makes a Layer 3 decision (is the destination IP address local?) and uses ARP to link Layer 3 to Layer 2. The switch works only at Layer 2. No device in the middle ever looks at the IP header.

Phase 1: PC-A decides where the packet goes (steps 1 to 3)

Before anything is sent, PC-A has to answer one question: is PC-B on my own subnet, or somewhere else? The answer decides whose MAC address goes in the frame.

Phase 2: finding PC-B's MAC address (steps 4 to 6)

PC-A knows the destination IP address. To build an Ethernet frame, it also needs the destination MAC address. This is the job of ARP (Address Resolution Protocol).

Phase 3: building and delivering the frame (steps 7 to 11)

All eleven steps in one table

Here is the whole journey at a glance. Once the real frame is built in step 7, not a single address changes until it is delivered.

The reply: the journey back

PC-B's Echo Reply follows the same steps, but faster. PC-B makes the same local check (PC-A's address is in 192.168.10.0/24), finds PC-A's MAC address already in its ARP cache (learned from the request in step 5) and sends the reply straight away. SW1 already has both MAC addresses in its table, so no flooding happens at all.

The source and destination addresses simply swap places. The first ping is sometimes a little slower than the rest because only the first one has to wait for ARP.

A real-world example

In a small office, Priya clicks “Print” on her laptop (192.168.10.10). The printer is 192.168.10.20 on the same switch. Her laptop follows steps 1 to 11 exactly. It decides that the printer is local, uses ARP to find the printer's MAC address (if it has not printed recently) and builds frames addressed to the printer. The switch delivers them out of the printer's port. The office router could be switched off and printing would still work, because local traffic never needs it.

What happens when it fails

⚠️ The most useful clue is the ARP cache. If PC-A has a MAC address for PC-B, Layer 2 between them works, and the problem is higher up (for example, a firewall or a stopped service). If there is no MAC address, check the cabling, VLANs, power and IP settings.

Troubleshooting and useful commands

Work through the steps in order and check each one:

1. Steps 1 to 3: check your own IP address and mask with ipconfig (Windows) or ip addr (Linux).
2. Steps 4 to 6: ping the target, then look at the ARP cache with arp -a or ip neigh.
3. Steps 8 to 10: on a managed switch, check which port each MAC address was learned on with show mac address-table.

C:\>ping 192.168.10.20
Pinging 192.168.10.20 with 32 bytes of data:
Reply from 192.168.10.20: bytes=32 time=1ms TTL=128
Reply from 192.168.10.20: bytes=32 time<1ms TTL=128
Reply from 192.168.10.20: bytes=32 time<1ms TTL=128
Reply from 192.168.10.20: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.10.20:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

C:\>arp -a
Interface: 192.168.10.10 --- 0xb
  Internet Address      Physical Address      Type
  192.168.10.1          02-00-00-00-00-01     dynamic
  192.168.10.20         02-00-00-00-00-bb     dynamic
  192.168.10.255        ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static

$ ip neigh show
192.168.10.20 dev eth0 lladdr 02:00:00:00:00:bb REACHABLE
192.168.10.1 dev eth0 lladdr 02:00:00:00:00:01 STALE

SW1#show mac address-table dynamic
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0200.0000.0001    DYNAMIC     Gi0/3
   1    0200.0000.00aa    DYNAMIC     Gi0/1
   1    0200.0000.00bb    DYNAMIC     Gi0/2
Total Mac Addresses for this criterion: 3

Learn more: Essential Windows Network Commands · Essential Linux Network Commands

Common mistakes

• Thinking the router is involved. For same-subnet traffic, the default gateway is never used. Even if the gateway setting is wrong, local traffic still works.
• Thinking PC-A sends an ARP request before every packet. It only uses ARP when the address is not in its ARP cache. Most packets skip steps 5 and 6.
• Thinking the switch reads IP addresses. A Layer 2 switch forwards frames using MAC addresses only.
• Thinking the switch changes the frame. It forwards the frame unchanged. Only routers build new frames.
• Treating “Request timed out” as a network failure. If the ARP entry is there, Layer 2 works; the target may simply be blocking ping.
• Thinking the ARP reply is also a broadcast. The request is a broadcast, but the reply is unicast, sent only to the device that asked.

Knowledge check

Where to go next

You have followed a packet inside one subnet. Next, add a router and watch what changes in Different-subnet communication: the PC uses ARP to find the gateway instead, and the router builds a new frame. Then put everything together in What happens when you open a website?. To review the building blocks, read MAC addresses, ARP for local and remote destinations and Broadcast domains.