See the OSI Model with Packet Tracer

Trace packets through OSI Layers 1-4 in a two-subnet Packet Tracer network.

Introduction

30 Second Summary

Every time you load a web page, your data passes through multiple invisible layers of processing before reaching its destination. Understanding these layers is what separates someone who can troubleshoot a network from someone who just reboots the router.

In this project, you will build a two-subnet network in Cisco Packet Tracer and use Simulation Mode to visually trace packets through OSI Model Layers 1 through 4. You will watch data get encapsulated layer by layer, travel through switches and a router, and arrive at its destination.

What You'll Build

Picture yourself clicking through a frozen-in-time network, opening up any packet at any device, and seeing exactly which MAC addresses, IP addresses, and port numbers each layer adds or removes as data hops from your PC to a server on a different subnet.

By the end of this project, you'll have:

A working two-subnet network where you can ping across a router and watch ICMP packets traverse the network hop by hop.
Visual proof of encapsulation in action by inspecting PDU details and seeing what each OSI layer contributes to a packet.
A clear understanding of why Layer 2 headers change at the router while Layer 3 headers stay the same end-to-end.
Secret Mission: Use Challenge Mode to actively test whether you can predict what each device does at each layer.

Are there any prerequisites?

You need Cisco Packet Tracer 9.0.0 installed on your computer and a Cisco NetAcad or Skills for All account to sign in. Packet Tracer is free to download from the NetAcad Resource Hub.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to build and why it matters. This is your moment to commit to the goal before any hands-on work begins.

Build Your Physical Network

Every network starts with physical connections. Without cables carrying electrical signals between devices, no data can travel anywhere.

In this step, you will build a two-subnet network topology from scratch in Cisco Packet Tracer. You will place five devices and connect them with cables, creating the Layer 1 (Physical) foundation that every other layer depends on.

In this step, get ready to:

Place five network devices on the workspace.
Connect all devices with Copper Straight-Through cables.
Verify Layer 1 connectivity through green link indicators.

Place devices on the workspace

Your network needs five devices arranged left to right: a PC, a switch, a router, another switch, and a server. The router sits in the middle because its job is to connect two separate subnets.

In the bottom-left device panel, click the End Devices category.
Click PC in the device-specific selection box, then click on the left side of your workspace to place it.
Click the Network Devices category, then click the Switches subcategory.
Select the 2960 switch model and click to the right of the PC to place Switch0.
Switch to the Routers subcategory under Network Devices.
Select the 1941 router model and click to the right of Switch0 to place the Router.
Go back to Switches, select another 2960, and click to the right of the Router to place Switch1.
Switch to End Devices, select Server, and click to the right of Switch1 to place it.

You should now see five devices arranged left to right: PC, Switch0, Router, Switch1, Server.

Why this arrangement?

The two switches create two separate local networks (subnets). The router in the middle connects them. This is the same basic architecture used in offices, data centers, and home networks with multiple segments.

Cable the devices together

Copper Straight-Through cables connect devices of different types (PC to switch, switch to router). You will create four cable connections to link the entire network.

In the bottom-left device panel, click the Connections category (lightning bolt icon).
Select Copper Straight-Through from the cable options.
Click the PC, then select FastEthernet0 from the popup menu. Click Switch0 and select FastEthernet0/1.
Click Switch0 and select GigabitEthernet0/1. Click the Router and select GigabitEthernet0/0.
Click the Router and select GigabitEthernet0/1. Click Switch1 and select GigabitEthernet0/1.
Click Switch1 and select FastEthernet0/1. Click the Server and select FastEthernet0.

What do these port names mean?

FastEthernet ports run at 100 Mbps. GigabitEthernet ports run at 1000 Mbps. The numbers after the slash (like 0/1) identify the specific port on the device. PCs and servers have a single FastEthernet0 port, while switches and routers have multiple numbered ports.

After connecting each cable, you will see link indicators (small triangles) appear at both ends of the connection.

Don't see the port popup when you click a device?

Make sure you selected a specific cable type first (Copper Straight-Through), then clicked the device. If you click a device without selecting a cable, the device's configuration window opens instead.

If you connected to the wrong port, click the Delete tool (X icon) and click the incorrect cable to remove it, then try again.

Help me fix my cable connections in Packet Tracer.

Observe Layer 1 in action

Before you check the link lights, what color do you think the indicators should be if your physical connections are working correctly?

Look at the triangles on each cable connection. You should see green triangles at both ends of every cable. Green means the physical connection is active and electrical signals can pass through.

What is Layer 1 (Physical)?

Layer 1 of the OSI Model is the Physical layer. It answers one question: can the electrical signal get from point A to point B? Green link lights prove that the answer is yes.

At this layer, there is no intelligence. The devices do not know each other's names, addresses, or purpose. All that matters is whether the cable can carry a signal.

Seeing orange triangles instead of green?

Orange (amber) triangles mean the switch ports are running through STP (Spanning Tree Protocol) convergence. The switch is checking for network loops before allowing traffic. Wait about 30 seconds and the triangles will turn green on their own.

If they stay orange after a full minute, double-check that you used Copper Straight-Through cables and connected to the correct ports listed above.

Why are my Packet Tracer link lights staying orange?

Your physical network is complete. Every cable shows green, which means Layer 1 is working. Next up, you will give these devices IP addresses so they can actually identify and talk to each other across the two subnets.

Configure IP Addresses and Hit the Wall

Your cables are connected and every link light glows green. Layer 1 is working perfectly.

But physical connectivity is only the first piece of the puzzle. Without Layer 3 addresses, devices have no way to identify each other across different networks. In this step, you'll configure IP addresses on the PC and Server, then attempt to communicate across subnets. The result will surprise you.

In this step, get ready to:

Configure the PC with an IP address, subnet mask, and default gateway.
Configure the Server with an IP address and enable its HTTP service.
Attempt a ping across subnets and observe what happens.

Configure the PC

Every device on a network needs a Layer 3 identity to communicate beyond its local cable. For the PC, that means an IP address (its unique identity), a subnet mask (which defines its local network boundary), and a default gateway (where to send traffic destined for other networks).

Click the PC on your workspace to open its configuration window.
Click the Desktop tab at the top of the window.
Click IP Configuration.
In the IP Address field, type 192.168.1.10.
In the Subnet Mask field, type 255.255.255.0.
In the Default Gateway field, type 192.168.1.1.

The values appear immediately in the fields. The PC now knows its Layer 3 identity and where to send traffic destined for other subnets.

What do these values mean?

The IP address 192.168.1.10 puts the PC on the 192.168.1.0 network. The subnet mask 255.255.255.0 tells the PC that any address starting with 192.168.1.x is local (no router needed).

The default gateway 192.168.1.1 is the router's address on this subnet. Any traffic going to a different network (like 192.168.2.x) gets sent to the gateway first.

Configure the Server

The Server lives on a different subnet (192.168.2.0). It needs its own Layer 3 identity so the PC can reach it across the router.

Click the Server on your workspace to open its configuration window.
Click the Desktop tab at the top.
Click IP Configuration.
In the IP Address field, type 192.168.2.10.
In the Subnet Mask field, type 255.255.255.0.
In the Default Gateway field, type 192.168.2.1.

Now enable the HTTP service so the Server can respond to web requests later in the project.

Click the Services tab at the top of the Server window.
Click HTTP in the left sidebar.
Confirm the service is set to On. If it shows Off, click On to enable it.

You should see the HTTP service status showing On, confirming the Server will respond to web traffic on port 80.

Don't see the HTTP option?

Make sure you clicked the Services tab (not Desktop or Config). The HTTP option appears in the left sidebar of the Services tab.

If you accidentally placed a PC instead of a Server, the Services tab won't appear. Delete the device and place a new one from End Devices > Server.

Need more help? Why can't I find the HTTP service on my Server in Packet Tracer?

Attempt to ping across subnets

Both devices now have Layer 3 addresses. The cables are connected (Layer 1 works). Time to test whether the PC can reach the Server.

Click the PC on your workspace.
Click the Desktop tab.
Click Command Prompt.

Before you run the next command, make a prediction. The cables are connected. Both devices have IP addresses. Do you think the ping will succeed or fail?

Type the following command and press Enter:

ping 192.168.2.10

The ping fails. You'll see Request timed out or Destination host unreachable for every attempt.

This is expected and intentional. You just hit the wall.

Why did the ping fail?

The router sitting between the two subnets is the problem. Its interfaces (GigabitEthernet0/0 and GigabitEthernet0/1) have no IP addresses assigned and are administratively shut down.

Even though the cables are physically connected (Layer 1 works), there is no Layer 3 path between the subnets. The router is just a box with powered-off doors. Traffic from the PC reaches Switch0 but has nowhere to go next.

This is the key lesson: physical connectivity (Layer 1) does not guarantee end-to-end communication. You need Layer 3 routing to bridge separate networks.

Seeing something other than Request timed out?

If you see replies succeeding, double-check that the Server's IP is on a different subnet (192.168.2.10, not 192.168.1.10). If both devices are on the same subnet, the ping bypasses the router entirely.

If you see no output at all, make sure you pressed Enter after typing the command. The ping takes several seconds to complete all four attempts.

Still stuck? Help me figure out why my ping result is different from expected in Packet Tracer.

You've just proven something fundamental. Working cables (Layer 1) are necessary but not sufficient for cross-network communication. In the next step, you'll bring the router to life and watch that same ping succeed.

Bring the Router to Life

In the last step, you proved that physical connectivity alone is not enough. Your ping to the server failed even though all the cables are connected and link lights are green.

Now you'll configure the router to create the Layer 3 bridge between your two subnets. This is what routers do. They connect networks by making forwarding decisions based on IP addresses.

In this step, get ready to:

Configure the router's interfaces with IP addresses.
Verify both interfaces are up and running.
Test end-to-end connectivity with a successful ping.

Configure the router interfaces

The router has two interfaces that connect to your two subnets. Both are currently shut down by default. You need to assign each one an IP address and power them on.

Click the Router in your workspace.
Go to the CLI tab.
Press Enter to get the router prompt.
Enter these commands to configure both interfaces:

enable
configure terminal
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
ip address 192.168.2.1 255.255.255.0
no shutdown
end

What do these commands do?

enable enters privileged EXEC mode, giving you access to configuration commands.
configure terminal enters global configuration mode where you can change the router's settings.
interface GigabitEthernet0/0 selects the interface connected to Switch0 (the PC's subnet).
ip address 192.168.1.1 255.255.255.0 assigns the IP address that matches the PC's default gateway.
no shutdown powers on the interface. Router interfaces are administratively shut down by default.
The same process repeats for GigabitEthernet0/1 with the server's subnet address (192.168.2.1).
end returns you to privileged EXEC mode.

After entering no shutdown on each interface, you'll see messages confirming the interfaces came online:

%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up

These messages confirm that the physical link (Layer 1) and the data link protocol (Layer 2) are now active on that interface.

Seeing an error instead?

If you see % Invalid input detected at '^' marker, double-check you typed the command exactly as shown. A common mistake is misspelling GigabitEthernet or missing the space between ip address and the IP.
If you see Router> instead of Router#, you forgot to type enable first. Type it now to enter privileged mode.
Still stuck? Help me troubleshoot my router configuration in Packet Tracer.

Verify the router configuration

Still on the router CLI, type this command to check both interfaces:

show ip interface brief

You should see both GigabitEthernet0/0 (192.168.1.1) and GigabitEthernet0/1 (192.168.2.1) with Status showing up and Protocol showing up.

What does up/up mean?

The show ip interface brief output has columns for Interface, IP-Address, OK?, Method, Status, and Protocol.

Status up means Layer 1 (physical) is working. Protocol up means Layer 2 (data link) is working. Together they confirm the interface is fully operational and ready to route traffic.

Seeing down or administratively down?

If Status says administratively down, you missed the no shutdown command for that interface. Go back into configuration mode and run it:
Type configure terminal, then interface GigabitEthernet0/0 (or 0/1), then no shutdown, then end.
Help me fix my router interface status Why does my router interface show administratively down in Packet Tracer?.

Test end-to-end connectivity

Both interfaces are up. Time to see if your fix worked.

Click the PC in the workspace.
Go to the Desktop tab, then click Command Prompt.

Before you run the next command, think about it: will the ping succeed this time? What changed since your last attempt?

Type this command and press Enter:

ping 192.168.2.10

This time you should see successful replies (Reply from 192.168.2.10). The first one or two pings may time out. That is normal.

Why do the first pings time out?

The first timeout happens because of ARP (Address Resolution Protocol). Before sending a packet, a device needs to learn the destination's MAC address at Layer 2. The PC broadcasts an ARP request to find the router's MAC, and the router does the same for the server.

This brief delay only happens the first time. After ARP resolves the addresses, subsequent pings succeed immediately.

Ping still failing?

Make sure you ran no shutdown on both router interfaces. Run show ip interface brief on the router again to confirm both show up / up.
Check the PC's default gateway is set to 192.168.1.1 (click the PC, go to Desktop > IP Configuration).
Check the Server's default gateway is set to 192.168.2.1.
Try running ping 192.168.2.10 a second time. If the first attempt timed out entirely, the second attempt often succeeds once ARP tables are populated.
Help me debug Why is my ping still failing after configuring the router?.

Your Layer 3 path is now complete. Packets can travel from the PC, through the router, and reach the server on the other subnet. Next up, you'll switch to Simulation Mode and watch exactly what happens inside those packets at every layer.

Watch a Packet Travel Through All Four Layers

Your network is alive. Pings travel from the PC across two subnets to the Server and back. But in Realtime mode, all of that happens invisibly. You cannot see why it works.

Cisco Packet Tracer has a Simulation Mode that lets you freeze time and step through packets one hop at a time. You can open any packet at any device and see exactly what each OSI layer contributes. In this step, you will generate HTTP traffic and inspect it layer by layer.

In this step, get ready to:

Switch from Realtime to Simulation Mode.
Generate HTTP traffic from the PC to the Server.
Inspect a packet and identify information at Layers 2, 3, 4, and 7.

Switch to Simulation Mode and generate HTTP traffic

Simulation Mode pauses all network activity so you can advance packets manually. You will generate HTTP traffic from the PC's Web Browser, then watch it appear in the Event List.

In the bottom-right corner of the Packet Tracer window, click the Simulation tab (the clock icon with a magnifying glass) to switch from Realtime mode.
The workspace changes to show the Simulation Panel with an empty Event List.

Now generate traffic for Simulation Mode to capture.

Click the PC to open its configuration window.
Go to the Desktop tab.
Click Web Browser.
In the URL bar, type http://192.168.2.10 and press Enter (or click Go).

The page will not load yet. That is expected. Simulation Mode has paused all traffic, and you should see events starting to appear in the Event List panel on the right.

Why doesn't the page load?

In Simulation Mode, packets do not move automatically. They wait for you to advance them manually using the Capture/Forward button. This is what gives you the power to inspect each packet at each hop.

Don't see any events in the Event List?

Make sure you switched to Simulation Mode before typing the URL. If you typed it in Realtime mode, the traffic already passed through invisibly. Switch to Simulation, then type the URL again.

Also confirm the URL is exactly http://192.168.2.10 with no typos.

Help me troubleshoot my Simulation Mode Event List

Step through the traffic hop by hop

Each click of the Capture/Forward button advances all waiting packets by one hop. You are about to watch Layer 1 (Physical) in action as signals move along cables from device to device.

In the Simulation Panel, click the Capture/Forward button (the right-pointing arrow with a bar).
Watch the animated envelope move from the PC toward Switch0.
Click Capture/Forward again to advance the packet to the Router.
Keep clicking Capture/Forward until you see the packet reach the Server.

As you step through, the Event List fills with entries. You will see DNS, TCP, and HTTP events appear. Each row represents a packet at a specific device at a specific moment in time.

What are all these events?

Before the PC can send HTTP data, several things happen at different layers. A TCP three-way handshake establishes a connection at Layer 4. DNS may resolve the address. Only then does the HTTP request travel. Each of these shows up as a separate event.

You are watching the full stack in action. Every animated envelope moving along a cable is Layer 1 doing its job.

Inspect a PDU at the PC to see all four layers

Now for the real payoff. You will open a single packet and see exactly what each OSI layer added to it. This is encapsulation made visible.

In the Event List, find the first HTTP event (look for "HTTP" in the Type column at the PC).
Click the colored square in the Info column for that event. The PDU Information window opens.
Click the OSI Model tab.

You are now looking at a single packet broken down by OSI layer. The In Layers column reads from bottom to top (Layer 1 up to Layer 7).

Click through each layer in the OSI Model tab and note what information appears.

What does each layer show?

Layer 7 (Application) shows "HTTP client sends a request." This is your web browser asking for a page.
Layer 4 (Transport) shows a Source Port (a random number like 1025) and a Destination Port (80). Port 80 is the standard HTTP port.
Layer 3 (Network) shows Source IP 192.168.1.10 and Destination IP 192.168.2.10. These are the addresses you configured.
Layer 2 (Data Link) shows the Ethernet frame with a source MAC address (the PC's) and a destination MAC address. The destination MAC here is the router's MAC, not the server's. The PC sends its frame to its default gateway at Layer 2.

This is encapsulation. Each layer wraps the data with its own header. Layer 7 creates the request. Layer 4 adds port numbers. Layer 3 adds IP addresses. Layer 2 adds MAC addresses. Layer 1 converts everything to electrical signals on the wire.

Before you close the PDU Information window, take a moment. What do you think will happen to the Layer 2 MAC addresses when this packet reaches the router?

Can't find the HTTP event in the Event List?

You may need to click Capture/Forward several more times. TCP handshake events (SYN, SYN-ACK, ACK) appear before the HTTP event. Keep advancing until you see "HTTP" in the Type column.

If the Event List is empty, go back to the PC Web Browser and re-enter http://192.168.2.10 while still in Simulation Mode.

Help me find and inspect an HTTP event in Packet Tracer Simulation Mode

You have just seen what textbooks only describe. Every layer of the OSI model is visible in one window. Next, you will zoom into the router to witness the most important networking concept: Layer 2 changes at every hop while Layer 3 stays the same end-to-end.

See Layers 2 and 3 Separate at the Router

In the last step, you watched packets travel hop by hop and inspected encapsulation at the PC. You saw how each OSI layer wraps data with its own header before sending it out.

Now comes the most powerful insight in networking. Layer 2 (MAC addresses) changes at every hop, while Layer 3 (IP addresses) stays the same from source to destination. You will prove this by comparing what the router receives versus what it sends out.

In this step, get ready to:

Inspect a packet at the router and open both Inbound and Outbound PDU Details.
Compare the Layer 2 Ethernet headers to see how MAC addresses change at the router.
Confirm that Layer 3 IP addresses and Layer 4 TCP ports remain unchanged end-to-end.

Inspect the PDU at the router

The router is the device that connects your two subnets. When a packet arrives on one interface, the router makes a forwarding decision and sends it out the other interface. This means it has both an inbound frame and an outbound frame you can compare.

In the Event List panel, find an event where the device column shows Router.
Click the colored square in the Info column for that Router event.

The PDU Information window opens. Notice it has three tabs: OSI Model, Inbound PDU Details, and Outbound PDU Details.

Why does the router have both Inbound and Outbound tabs?

The PC only had an Outbound tab because it was the sender. The router receives the packet on one interface AND forwards it out a different interface. That gives you two snapshots to compare: what arrived versus what left.

Compare Layer 2 inbound versus outbound

Before you click the Outbound tab, make a prediction. Do you think the MAC addresses in the outbound Ethernet header will be the same as the inbound ones, or different?

Click the Inbound PDU Details tab.
Look at the Ethernet II section. Note the DEST MAC value. This is the router's GigabitEthernet0/0 MAC address, because the PC sent the frame to its default gateway.
Now click the Outbound PDU Details tab.
Look at the Ethernet II section again. The SRC MAC is now the router's GigabitEthernet0/1 MAC address. The DEST MAC is the Server's MAC address.

Layer 2 was completely rebuilt. The router stripped the old frame and created a brand new one with different MAC addresses.

Why does Layer 2 change at the router?

Ethernet frames only travel between directly connected devices. When the PC sends to the router, it uses the router's incoming interface MAC as the destination.

When the router forwards to the server, it builds a fresh frame using its outgoing interface MAC as the source and the server's MAC as the destination. This is why Layer 2 is called "hop-by-hop" addressing.

Confirm Layer 3 and Layer 4 are unchanged

Now check whether the IP addresses changed between the two tabs. This is the moment where the difference between Layer 2 and Layer 3 becomes crystal clear.

On the Inbound PDU Details tab, look at the IP section. Note the SRC IP (192.168.1.10) and DST IP (192.168.2.10).
Switch to the Outbound PDU Details tab and check the IP section. SRC IP is still 192.168.1.10 and DST IP is still 192.168.2.10. They did not change.
Check the TCP section on both tabs. The Source Port and Destination Port (port 80 for HTTP) are identical on both sides. Layer 4 is also end-to-end.

This is the fundamental rule: Layer 3 addressing is end-to-end, Layer 2 addressing is hop-by-hop.

What about the switch?

Find a switch event in the Event List (where the device column shows Switch0 or Switch1) and click the colored square. Notice the switch only shows Layer 1 and Layer 2 processing. It never inspects IP addresses.

Switches are Layer 2 devices. They forward frames based on MAC addresses only. Routers are Layer 3 devices. They make forwarding decisions based on IP addresses and rebuild the Layer 2 frame for each hop.

Seeing identical MACs on Inbound and Outbound?

Make sure you clicked the colored square for an event at the Router, not at a switch. Switches pass frames without changing them, so their Inbound and Outbound MACs look the same.

Also confirm you have stepped far enough forward with Capture/Forward for the packet to actually reach the router. If the event is still at Switch0, step forward again until the device column reads Router.

Help me understand why my Inbound and Outbound MAC addresses look the same in Packet Tracer Simulation Mode.

Secret mission

Test Yourself with Challenge Mode

Knowing what happens is different from being able to predict what happens. Challenge Mode tests whether you truly understand what each device does at each layer. Can you answer every question at the router without using the Hint button?

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing cloud costs or subscriptions to worry about. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

Packet Tracer network topology (your two-subnet lab with PC, switches, router, and server).
Cisco Packet Tracer application (installed on your machine).

Keep everything running

No action needed. Choose this if you plan to continue experimenting with the topology, adding more devices, or revisiting Simulation Mode to explore other protocols.

Your topology stays open in Packet Tracer exactly as you left it.
You can save it at any time with Ctrl+S to preserve your work between sessions.

Pause - I'll come back to this later

Save your topology so you can reopen it later without rebuilding anything.

Press Ctrl+S in Packet Tracer to save your topology.
Choose a location on your Desktop or Documents folder and name the file something memorable (e.g. osi-lab.pkt).
Close Cisco Packet Tracer.
When you want to return, double-click the .pkt file to reopen your lab exactly where you left off.

Delete - I don't want to use this again

Remove all project resources and optionally uninstall Packet Tracer.

Close the topology in Packet Tracer without saving (click Don't Save when prompted).
If you previously saved a .pkt file, navigate to the folder where you saved it and delete it.
To uninstall Cisco Packet Tracer: press the Windows key, type Add or remove programs, and press Enter.
Find Cisco Packet Tracer in the list, click it, then click Uninstall.
Follow the uninstall prompts to remove the application from your machine.

Nice Work!

You just built a two-subnet network from scratch in Cisco Packet Tracer and used Simulation Mode to visually prove what each OSI layer contributes to a packet's journey.

You've learned how to:

Build a working multi-subnet network with proper Layer 1 cabling, Layer 3 IP addressing, and router configuration, then diagnose why physical connectivity alone does not enable cross-subnet communication.
Use Simulation Mode to freeze time, step through packets hop by hop, and inspect PDU details showing Layer 2 MAC addresses, Layer 3 IP addresses, and Layer 4 TCP port numbers at every device.
Identify the fundamental networking rule: Layer 2 headers change at the router (hop-by-hop) while Layer 3 headers remain the same end-to-end, proving why routers exist and how switches differ.
Use Challenge Mode to actively predict encapsulation and decapsulation actions at each layer on routers and switches, testing your understanding the way a certification exam would.

Ready to quiz yourself?