packet decapsulation

[icealys]

if the source address and all other low level header information gets decapsulated or removed by a server and the data reaches the server's application layer, then how does the application in the server know what source address to send the data back to if all that information was previously stripped away?

[thepowersgang]

Simple - The application is informed of how to address the return packets (through metadata associated with the data).

(This metadata might just be contained within the transport layer, i.e. a TCP connection, or be propagated up for UDP sockets)

[Combuster]

It's called a socket.

[icealys]

so if the application layer just receives the data without any of the headers...that means that the metadata would be part of the payload? The application on the server is what needs to send the data back to the client, so the application on the server would need to receive the metadata. I don't see it being anywhere else but the payload because all of the lower layers(3 and 4) are stripped away before it gets to the application.

[bluemoon]

Application get those meta data from socket abstraction and API.
For BSD-socket, you get the peer address upon recvfrom() for udp packet, and use such address to response.
For tcp, application can just response to a socket object without much care, or get address with getpeername().

[Kevin]

Why don't you just try and write some simple network servers and clients for one or two existing OSes? This would answer your question how existing OSes do things.

[icealys]

hmm...I looked up getpeername() and its part of the winsocks functions...does that invoke a system call or is that just a function to retrieve data in user space?

[thepowersgang]

Does it matter? It's implementation defined how those functions actually work, one system may do it as a specific system call, another might use an ioctl, a third might just read from a readonly page provided by the kernel, a fourth might have the entire networking stack in userland (and hence that call would never involve the kernel).