A packet is a small unit of data sent over a network, typically up to 1,500 bytes. It has headers with addressing and control information (IP addresses, ports, sequence numbers) and a payload with the actual data. Large transfers are split into many packets and reassembled at the destination.
How it works
Why packets?
Splitting data into packets lets many conversations share the same links, lets each packet take the best available path, and means a lost packet can be resent without resending everything.
What's inside
- Link header (Ethernet or Wi-Fi): source and destination MAC addresses, for the next hop only.
- IP header: source and destination IP addresses, TTL (hop limit), protocol, length.
- Transport header: TCP or UDP ports; for TCP also sequence and acknowledgement numbers and flags (SYN, ACK, FIN).
- Payload: the data, increasingly encrypted (TLS, QUIC).
- Frame check sequence: a checksum the receiving interface uses to detect corruption.
Strictly, the frame is the link-layer unit, the packet the IP unit, and the segment (TCP) or datagram (UDP) the transport unit, but “packet” is used loosely for all of them.
MTU
The maximum transmission unit is the largest packet a link can carry: 1,500 bytes on Ethernet and most Wi-Fi. VPNs and some connections (PPPoE) reduce it, and packets that are too big get fragmented or dropped, a classic cause of “small pages load, big ones don't”.
Examples
A DNS query is one small UDP packet of under 100 bytes; downloading a 10 MB file takes roughly 7,000 TCP packets of about 1,448 bytes of payload each.
tcpdump shows packet headers:
IP 192.168.1.23.53621 > 192.168.1.1.53: 41023+ A? apple.com. (27)
On a Mac
sudo tcpdump -i en0 -n -c 20prints 20 packet headers.netstat -ibshows packet counts and errors per interface.ping -D -s 1472 1.1.1.1tests whether full-size 1,500-byte packets pass without fragmentation (1,472 bytes of payload plus 28 bytes of headers).
See it in the app
LightAtom counts the bytes in all the packets of each connection, per app, without reading their contents.
Frequently asked questions
How big is a network packet?
Up to the link's MTU, usually 1,500 bytes on Ethernet and Wi-Fi. Many packets, like TCP acknowledgements, are much smaller.
What is the difference between a packet and a frame?
A frame is the link-layer unit (Ethernet or Wi-Fi) with MAC addresses; it carries an IP packet inside. In everyday use, people call both packets.
What happens when a packet is lost?
TCP notices and resends it; UDP-based apps like calls usually skip it. Either way, frequent loss hurts performance.
Can someone read my packets?
Anyone on the path can see headers (addresses and ports). Payloads protected by TLS or QUIC are encrypted, so contents stay private.