packet/data encapsulation

[threadhead]

heyho everyone!

i wondered how packet encapsulation works in detail.
i wanted to implement such encapsulation in C.

well in general you can say that a packet is nothing more than a structure filled with the needed infos sent over the wire with write().

lets assume we want to build an arp packet.


struct pseudoarp
{
struct arpheader
{
{
...
...
...
} arp;

struct etherheader
{
{
...
....
.....
} eth;
} arppacket;



so wouldnt be an encapsulation something like putting more "around" that structure to hide it?

something like this?


struct encapsulated
{
struct pseudoarp
{
struct arpheader
{
{
...
...
...
} arp;

struct etherheader
{
{
...
....
.....
} eth;
} arppacket;
} encapsulated;


think of that data being sent to a client connected to a stream server.
how would that client recognize the arp packet within the encapsulated one? or is there no need to recognize because that additional structure is not seen by the client?
and if yes, how are packets encapsulated then?

thanks alot for your time!

[bwkaz]

It's the other way around.

When a client sends an HTTP "packet" (HTTP is a stream protocol, so there aren't packets, but oh well, I'll ignore that for the moment), it's writing a simple string to the network socket. Something like "GET / HTTP/1.0\r\n" or similar.

The kernel socket interface reads this off the socket (well... more or less), and translates it into a TCP "struct", containing the TCP header information (because the protocol specified during connect() was TCP). Then, it passes it to the IP layer.

The IP layer takes the struct it gets from the TCP layer, and adds the IP header information around it. Then it passes it to the Ethernet layer.

The Ethernet layer adds an Ethernet header, and passes it to the low-level driver.

The driver writes the packet to the network card, which adds yet another layer on (for data integrity purposes) and sends the electrical signals out over the wire.

So in your example, it should look more like:

struct arppackettype
{
struct arpheader
{
{
...
...
...
} arp;

/* ARP data */
} arppacket;

struct etherpacketforARPtype
{
struct etherheader
{
...
...
} ether;

struct arppacket data;

/* perhaps more data */
} etherpacketforARP; Encapsulating this packet would put another header around it, and add some more data.

When a packet comes back, it's got all the header info in it -- Ethernet around the outside, IP just inside that, TCP inside that, and whatever else inside that (depends on the program it's going to).

This all gets recognized inside the kernel; applications don't have to worry about ID'ing packets at all (unless you're using the RAW interface; if you're doing that, why?).