Difference Between Segments, Packets and Frames

The terms “Segment”, “Packet”, “Datagram”, “Frames” etc are so much used and reused in different books and articles to convey different meanings, that it has now become totally confusing. Especially after the introduction of different layered architecture of network communication.

A good way to look at this is and clear the confusion, is to call them as “PDU (Protocol Data Unit)”. Irrespective of whether you are talking about network layer, transport layer or physical layer, the term PDU is generic and applies to all.

Of Course different layers add different fields on top of data, but they can still be called PDUs. Being said that, according to OSI reference layered architecture, below is what is widely accepted.

PDU of Transport layer is called as a “Segment”, PDU of network layer is called as a “Packet” & PDU of data link layer is called as a “Frame”.

Network communication is actually message oriented. As far as an application is concerned, the requirement might be to send a file to another machine on the network. Or download a particular file from a remote server. But you cannot send a file in one single message. You have to basically slice it out to different chunks and then send it out. Although applications can be programmed to do this, its going to be a lot of overhead for  programmers. Applications should then have logic about which chunk is sent, and acknowledged and which is remaining to be sent, which chunk needs to be resent etc. Also you will then have to come with a particular size for each chunk that the application will create. So basically more tedious job on application programming.

Rather than doing all of this slicing & sizing and creating of chunks by the application(which is possible), what if the application can submit a stream of data without worrying about the size and number of chunks to another software. This is what exactly TCP is capable of. So basically applications will send a stream of bytes to TCP(Without worrying at all about size and chunks. Its nothing but data stream in bytes), and TCP will take care of slicing it up and sending in discrete message form. 

So applications provide byte stream to TCP, and TCP takes care of creating it into discrete pieces of messages. These discrete pieces of messages at Transport Layer(where TCP comes into picture) are called "Segments".

How does a TCP Segment Look Like?

TCP segments can do multiple things at the same time. We know the fact that byte stream data provided by applications are sliced into different chunks called segments and are delivered to receiver separately. One single segment carry data along with acknowledgement of another segment. A TCP segment is made of different fields which carry different meanings.

This means a considerable amount of space in each segment is used for conveying different functions and controls(called headers). Data chunk is wrapped by these headers. Generally each segment has a dedicated 20 bytes section only for the headers.

To have a quick look into a segment, the best program available is tcpdump. One one terminal you can fire up the command sudo tcpdump -vvv -n host www.example.com and on the other terminal execute the command curl http://www.example.com

You should be able to see a stream of messages(in the first terminal where you fired up that tcpdump command) that looks like the below(it should also show you the HTTP protocol messages/and web page response as well, i have trimmed the output to bare minimum)

192.168.40.27.59365 > 93.184.216.34.80: Flags [S], cksum 0x6331 (correct), seq 1889608132, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 1304554704 ecr 0,sackOK,eol], length 0

93.184.216.34.80 > 192.168.40.27.59365: Flags [S.], cksum 0xdaa9 (correct), seq 3872433988, ack 1889608133, win 65535, options [mss 1460,sackOK,TS val 3936428224 ecr 1304554704,nop,wscale 9], length 0

The above two lines show the segment headers. All TCP segments will have similar looking headers. It will contain the below components.

• Source Port(59365 above)
• Destination Port(80 above)
• Flags(There is a long list of flags in TCP, that convey different meanings. I will not be going through each of these as they all require special attention, and our topic of discussion is not tcp headers.)
• Checksum(this is something that can be used to verify the integrity of the segment)

Read:  How Does TCP Segment Checksum work?

• Sequence Numbers(which helps in identifying different segments at the receiver end)
• Options(Some other important settings, which convey different meanings. There are a lot of these. As mentioned before, we wont be going into its details as we will divert from the heading of this article)

Let's now move on to the next topic in this article, that is the Packets. The Segment (which includes data chunk and its headers) are then passed down from Transport layer to the next layer called Network Layer. Here is where IP addresses steps in. I think out of all three(Segments, Packets & Frames), packets are something that's mostly correctly used in different places. As packets are discrete messages in Network Layer which has IP addresses, they are sometimes referred to as "IP packets".

Similar to the fields that convey different meanings in a segment, packets also has its own fields (headers). So a packet is nothing but a segment sitting inside. Packet ads its own fields on top of the segment.

The important fields added on top of segments while creating a packet in network layer are mentioned below.

• Source IP Address
• Destination IP Address
• TTL
• Identification

16:45:57.867336 IP (tos 0x0, ttl 64, id 57113, offset 0, flags [DF], proto TCP (6), length 64)
    192.168.40.27.59365 > 93.184.216.34.80: Flags [S], cksum 0x6331 (correct), seq 1889608132, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 1304554704 ecr 0,sackOK,eol], length 0
16:45:58.072306 IP (tos 0x28, ttl 54, id 0, offset 0, flags [DF], proto TCP (6), length 60)

The above shown tcpdump output is exactly same as previously shown. In the previous one, i have actually purposely removed the first and last line. This was to avoid confusion while we were discussing about segments.

The components you see in the first line are part of the packet header(along with the ip addresses shown in the second line). This control and functionality information(headers) consumes around 20 bytes minimum.

A "segment" which is now sitting inside a "packet", is now passed down to the next layer called data link layer. Data link layer will add its own control and functional fields on top of the packet(called headers) to make something called as a "frame".

What is a Frame?

Frame is the name used to represent the Protocol Data Unit(PDU) at one of the lowest level in the reference model. Its the PDU at data link layer. Any communication between two computers or two networking devices is always done using MAC addresses. MAC addresses are nothing but physical addresses associated with the network interface card.

If you want to deliver a message to another machine on a network, it will first search for the physical address of the destination. There is actually something called as ARP, that does the job of translating IP addresses to Physical addresses. ARP(address resolution protocol) is one of the core components in networking.

Every operating system with networking capability, has this feature called ARP. It does the job of maintaining a mapping between ip addresses and corresponding MAC addresses(Physical address).

If there is no mapping found in the table for a destination IP address, what generally happens is that it gets forwarded to the gateway. Gateway will do the job of again searching the ARP table in its own system, and if the destination found it will deliver the message to the correct destination physical address. If its not found the gateway will forward it again to the next gateway. This forwarding of packets from gateway to next gateway is done till the final destination is reached.

Recommended Reading: How Address Resolution Protocol Works?

Similar to Segments & Packets, frame also adds its own header(things that control the frame). The most important things to understand about a frame is its header. The data inside the frame (or the payload) is nothing but the ip packet from network layer.

• Source Mac Address
• Destination Mac Address
• Data(Payload - its nothing but the network packet given by the network layer)
• Length(total length of the data - Typically its 1500 bytes.)
• Checksum(CRC)