Examkin

Question

Difficulty: Very hardEncapsulation and De-encapsulation

A network engineer captures network traffic using a packet analyzer at two points along a multi-hop path: at an ingress interface of an intermediate router and directly at the destination server's network adapter. The captured traffic consists of standard TCP-based application data traversing distinct IPv4 subnets. Which of the following statements accurately describe how encapsulation and de-encapsulation operate across these processing points? (Select TWO)

  1. The intermediate router strips the incoming Layer 2 frame header and trailer, inspects the Layer 3 IP header for forwarding decisions, and prepends a new Layer 2 frame header and trailer containing updated source and destination MAC addresses.Answer
  2. At the destination server, the network interface card processes and strips the Layer 2 frame header and trailer before passing the enclosed Layer 3 packet up to the operating system's protocol stack for Layer 3 IP header processing.Answer
  3. C
    The intermediate router strips both the Layer 2 frame header and the Layer 3 IP packet header, encapsulating the underlying Layer 4 TCP segment into a new IP packet with the router's own interface IP address set as the source.
  4. D
    The destination host's physical network interface card decapsulates all protocol headers (Layer 2, Layer 3, and Layer 4) directly in hardware before delivering the raw application data payload into user space memory.

Answer

The correct statements are: (1) The intermediate router strips the incoming Layer 2 header/trailer, inspects the Layer 3 IP header, and prepends a new Layer 2 header/trailer with updated MAC addresses; and (2) At the destination server, the network interface card processes and strips the Layer 2 header/trailer before passing the Layer 3 packet to the OS protocol stack.
Encapsulation and de-encapsulation follow specific boundaries at intermediate devices and destination endpoints. An intermediate router operates at Layer 3: it receives a Layer 2 frame, strips the frame header and trailer, checks the Layer 3 IP header to determine the outbound interface/next-hop, and encapsulates the IP packet into a new Layer 2 frame with updated source and destination MAC addresses. At the receiving host, de-encapsulation moves up the stack sequentially: the network interface card verifies the Frame Check Sequence and strips the Layer 2 header before handing the payload (the IP packet) to the operating system network stack for Layer 3 and Layer 4 de-encapsulation.

Step-by-Step Solution

1
Analyze intermediate router PDU processing during traversal
Identified that routers perform hop-by-hop Layer 2 decapsulation and re-encapsulation while preserving the Layer 3 IP packet header unchanged.
Routers operate at Layer 3. They discard the incoming Data Link frame header/trailer after verification, look up the destination IP address in the routing table, and create a brand-new Data Link frame header/trailer for the next hop.
2
Analyze host de-encapsulation workflow upon PDU reception
Verified layer-by-layer de-encapsulation handoff from hardware NIC to operating system software stack.
The Physical/Data Link hardware (NIC) strips the Layer 2 Ethernet header after checking the Frame Check Sequence (FCS), then passes the encapsulated IP packet up to the OS kernel stack to process Layer 3 IP headers and Layer 4 TCP headers.
3
Evaluate distractor claims regarding header removal and hardware capabilities
Rejected claims suggesting routers strip Layer 3 IP headers or that NIC hardware strips Layer 3/4 headers.
Routers do not regenerate Layer 3 IP headers unless NAT is active, and NIC hardware does not process upper-layer protocol boundaries such as TCP segments.

Key Concept

Hop-by-hop Layer 2 re-encapsulation vs bottom-up host de-encapsulation
Rate this question

Topics

Encapsulation and De-encapsulation

More questions from this topic