Packet

Packet switching was conceived independently by Paul Baran at RAND in the early 1960s, as "message blocks" in a survivable distributed network, and by Donald Davies at the UK National Physical Laboratory, who coined the word "packet" in 1965; ARPANET put the idea into practice from 1969. Strictly, the names differ by layer: the link layer sends frames, IP sends packets (or datagrams), TCP sends segments and UDP sends datagrams. Each layer encapsulates the one above, so a typical Ethernet frame contains a 14-byte Ethernet header, an IPv4 header of 20 to 60 bytes, a TCP header of at least 20 bytes, the payload and a 4-byte frame check sequence.

The IPv4 header (RFC 791) holds version and header length, DSCP/ECN bits for quality of service and congestion signalling, total length, an identification field, the DF and MF flags and fragment offset used for fragmentation, time to live (TTL), the protocol number of the payload (6 for TCP, 17 for UDP), a header checksum and the source and destination addresses. IPv6 (RFC 8200) replaces this with a fixed 40-byte header with a hop limit, a flow label and a chain of extension headers, and drops the header checksum. Every router decrements TTL or hop limit and discards the packet at zero, returning an ICMP Time Exceeded message; traceroute exploits exactly this to map the path.

Packet size is bounded by the MTU of each link, 1500 bytes of payload on standard Ethernet, giving a TCP maximum segment size of 1460 bytes over IPv4 without options. IPv4 routers may fragment packets that do not have DF set, while in IPv6 only the sender fragments and every link must carry at least 1280 bytes. Path MTU Discovery (RFC 1191 for IPv4, RFC 8201 for IPv6) depends on ICMP "Fragmentation Needed" and "Packet Too Big" messages, so firewalls that block all ICMP create black holes: small requests work but large transfers hang, a classic symptom after adding VPN tunnels whose headers shrink the usable MTU.

Packets can be lost, duplicated, reordered or corrupted, and IP itself does nothing about it; recovery is up to the transport or the application. Security tools work at different depths: stateless filters read only headers, stateful firewalls add flow context, and deep packet inspection reassembles streams to look at content. Fragmentation and overlapping segments have long been used to crash stacks (Teardrop, Ping of Death) and to evade intrusion detection systems that reassemble differently from the target host, a problem described by Ptacek and Newsham in 1998. For investigations, full packet capture (pcap files from tcpdump or Wireshark) gives complete evidence but is costly to store, whereas flow records such as NetFlow or IPFIX keep only metadata; with most traffic encrypted by TLS, metadata is increasingly all that can be inspected anyway.