Separate the delivery header from the payload
01Generic Routing Encapsulation (GRE) puts a small protocol-identifying header around a payload packet, then carries that inside a delivery protocol.
Egress 192.0.2.2 removes the delivery and GRE wrappers. Subsequent forwarding uses the inner packet’s destination, not the former outer destination.
Source for this drawing: RFC 2784 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The outer header reaches the tunnel exit; the inner packet keeps its own destination.
- RFC 2784 defines delivery header → GRE header → payload packet. Tunnel selection and setup are outside the base encapsulation specification.
- For IPv4 delivery, the outer IP Protocol field is 47. This is an IP protocol number, not UDP or TCP port 47; no UDP header is added here.
- For an IPv4 payload, the GRE Protocol Type MUST be hexadecimal 0800. Outer Protocol 47 and GRE Protocol Type 0800 are different fields with different jobs.
The examples use IPv4 delivery and payload, documentation addresses and a 20-byte outer IP header without options. The publication’s appendix notes that its then-deployed intersection did not include IPv6; no universal prohibition on later IPv6 GRE is inferred. GRE itself does not encrypt or authenticate the payload.
Read the RFC section ↗