Network stack and routing
Send a message across a network and it does not travel as one lump. It gets wrapped, and each wrapper is addressed to a different distance.
The innermost part is the payload, the thing you actually meant to send. Around it goes a layer 3 header holding the address of the machine that should eventually receive it. Around that goes a layer 2 header holding the address of the next device on this one physical link, and nothing further.
Layer 2 is commonly called the link layer and layer 3 the network layer, but the numbers are enough to follow what happens next.
The split matters because the two headers answer different questions. Layer 3 answers "where is this ultimately going." Layer 2 answers "who hands it along next." One stays fixed for the whole trip. The other is replaced at every boundary.
Walk a packet through
Two networks, two switches, one router
The path, per-hop headers, and the router's layer 2 rewrite are computed from the small topology model above, and the layer 3 addresses are real RFC 1918 private IPv4 addresses (one /24 subnet per network). The layer 2 labels are deliberately simplified stand-ins, not real MAC addresses, and how the devices learn where to forward (ARP, routing tables) is not modeled here at all.
- route
- Host A to Host C (crosses the router)
- hop
- 0 / 4
- current device reads
- payload
Two networks, two jobs
The map below the headers has two small networks. Each has its own switch and its own block of addresses. One router sits between them, with a foot in each network and a separate address on each side.
Send from Host A to Host B and the packet never reaches the router. Both hosts sit in the same network, so the switch alone can finish the job. It reads the layer 2 header, looks the destination up in its forwarding table, and forwards the frame out of the port for that host. The layer 3 header is present the whole time and nobody looks at it.
That is the whole job of a switch. It moves traffic inside one network and it never needs to know that any other network exists.
The rewrite
Send from Host A to Host C and the picture changes at one specific moment.
Host A wraps the payload as before, but the layer 2 header on the first leg is not addressed to Host C. It is addressed to the router's near-side interface, because that is the only device on this network that can help. Layer 3 still carries Host C's address, unchanged.
The near switch forwards it to the router, reading layer 2 and nothing else.
Then the router does the thing this whole topic exists to show. It reads the layer 3 header to learn the final destination. It throws the layer 2 header away. It writes a brand new one, this time addressed from its own far-side interface to Host C. The layer 3 addresses are not touched.
Step to that hop and compare the two layer 2 boxes. The old one is struck through and gone. The new one carries different addresses on both sides. The layer 3 box inside it reads exactly what it read at the start.
The far switch then forwards the rewritten frame the same way the near switch did, and Host C strips both headers and reads the payload.
Why it is built this way
A layer 2 (MAC) address is globally administered, assigned by the hardware maker so it is unique worldwide. It is only used on one link, though, because the router rewrites it at every hop. It gets thrown away the moment the packet leaves that link, and the worldwide uniqueness costs the networks nothing: it was arranged once, by the manufacturer, and each link only ever has to tell its own devices apart.
The layer 3 address does the opposite. It stays fixed end to end, which means a sender only needs to know one address for a destination that might be twenty networks away, and every router along the path reads that same address to make its own local decision about where to send it next.
Every boundary crossing is a fresh layer 2 header wrapped around a layer 3 header that has not changed since it was written.