Free lesson · Computer Networking

Encapsulation And Decapsulation

Easy10 min readnetworkingcomputer-networkstcp-ip

The Nesting-Doll Mechanism

The layered model is an elegant idea - each layer handles one responsibility and passes work to the layer below. But how does this actually work at the byte level? How does each layer "wrap" data so the receiving machine can "unwrap" it in the correct order?

The answer is encapsulation. When data moves down through the layers on the sending machine, each layer takes the data it receives from the layer above, adds its own header (and sometimes a trailer) to the front (and back), and passes the entire package to the layer below. Each layer treats everything it receives from above as opaque payload - it does not inspect or modify the content from the upper layer. It simply wraps it in its own control information and passes it down.

Think of Russian nesting dolls (matryoshka). The innermost doll is your actual data - the message your application wants to send. Each successive doll is a header added by a lower layer. The outermost doll is the frame header added by the data link layer, ready for physical transmission. On the receiving side, each layer removes its own doll (strips its own header), reads the control information it needs, and passes the remaining inner dolls up to the next layer.

graph TD
    subgraph Sending["Sending Machine - Encapsulation"]
        direction TB
        S1["Application Layer<br/>Creates DATA"] --> S2["Transport Layer<br/>Adds TCP Header → SEGMENT"]
        S2 --> S3["Network Layer<br/>Adds IP Header → PACKET"]
        S3 --> S4["Data Link Layer<br/>Adds Frame Header + Trailer → FRAME"]
        S4 --> S5["Physical Layer<br/>Converts to BITS<br/>⚡ Electrical/Optical Signals"]
    end

    S5 -.->|"Transmission<br/>Over Network"| R5

    subgraph Receiving["Receiving Machine - Decapsulation"]
        direction BT
        R5["Physical Layer<br/>Receives BITS"] --> R4["Data Link Layer<br/>Strips Frame Header → PACKET"]
        R4 --> R3["Network Layer<br/>Strips IP Header → SEGMENT"]
        R3 --> R2["Transport Layer<br/>Strips TCP Header → DATA"]
        R2 --> R1["Application Layer<br/>Reads DATA"]
    end

    style S1 fill:#4f46e5,stroke:#4338ca,color:#fff
    style S2 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style S3 fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style S4 fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style S5 fill:#c4b5fd,stroke:#a78bfa,color:#000
    style R1 fill:#4f46e5,stroke:#4338ca,color:#fff
    style R2 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style R3 fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style R4 fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style R5 fill:#c4b5fd,stroke:#a78bfa,color:#000

This diagram shows two machines side by side. On the left, the sending machine performs encapsulation - the Application Layer creates data, the Transport Layer adds a TCP header to create a segment, the Network Layer adds an IP header to create a packet, the Data Link Layer adds a frame header and trailer to create a frame, and the Physical Layer converts everything to bits transmitted as signals. The bits travel across the network to the receiving machine on the right, which performs decapsulation in reverse order - the Physical Layer receives bits, the Data Link Layer strips the frame header to reveal the packet, the Network Layer strips the IP header to reveal the segment, the Transport Layer strips the TCP header to reveal the data, and the Application Layer reads the original data.

Protocol Data Units - The Name Changes at Each Layer

Each layer's "package" has a specific name. These names appear constantly in networking documentation, Wireshark captures, and technical discussions:

Layer	Protocol Data Unit (PDU)	What It Contains
Application	Data (or Message)	The raw application payload - an HTTP request, a DNS query, an email message
Transport	Segment (TCP) or Datagram (UDP)	Transport header (source port, destination port, sequence number, flags) + Application data
Network	Packet	IP header (source IP, destination IP, TTL, protocol identifier) + Transport segment
Data Link	Frame	Frame header (source MAC, destination MAC) + IP packet + Frame trailer (error check)
Physical	Bits	Raw 1s and 0s transmitted as electrical, optical, or radio signals

Understanding these names matters because documentation and tools use them precisely. When Wireshark shows you an "Ethernet frame," you know you are looking at Layer 2 data. When a textbook discusses "IP packets," you know it is talking about Layer 3. When someone mentions "TCP segments," you know they are discussing Layer 4 behavior. The vocabulary is not arbitrary - it tells you exactly which layer is being discussed.

Step-by-Step Encapsulation - A Concrete Example

Let us trace exactly what happens when your browser sends an HTTP request to www.example.com. We will follow the data as it moves down through each layer on your machine.

Step 1 - Application Layer Creates the Data

Your browser constructs an HTTP GET request:

GET /index.html HTTP/1.1
Host: www.example.com
Accept: text/html
Connection: keep-alive

This is the application-layer data - a plain-text HTTP message. The application layer hands this data to the transport layer with the instruction: "deliver this to port 80 on the destination machine."

Step 2 - Transport Layer Creates a Segment

The transport layer (TCP in this case) takes the HTTP data and wraps it in a TCP header. The TCP header contains critical control information:

Source port: A random high-numbered port (e.g., 52431) assigned by your OS
Destination port: 80 (the well-known port for HTTP)
Sequence number: Tracks the order of data within the TCP connection
Acknowledgment number: Confirms which data has been received
Flags: SYN, ACK, FIN, PSH, etc. - control flags that manage the connection state
Window size: How much data the sender can accept before needing an acknowledgment
Checksum: Error detection for the header and data

The result is a TCP segment: [TCP Header] [HTTP Data]

Step 3 - Network Layer Creates a Packet

The network layer (IP) takes the entire TCP segment - header and payload - and wraps it in an IP header:

Source IP address: Your machine's IP (e.g., 192.168.1.42)
Destination IP address: The resolved IP of www.example.com (e.g., 93.184.216.34)
TTL (Time to Live): A counter (e.g., 64) that decrements at each router hop and prevents packets from looping infinitely
Protocol: A field identifying the transport protocol (6 = TCP, 17 = UDP)
Header checksum: Error detection for the IP header itself

The result is an IP packet: [IP Header] [TCP Header] [HTTP Data]

Step 4 - Data Link Layer Creates a Frame

The data link layer (Ethernet) takes the entire IP packet and wraps it in an Ethernet frame:

Destination MAC address: The MAC address of the next hop (your router, not the final destination)
Source MAC address: Your machine's MAC address
EtherType: Identifies the network-layer protocol (0x0800 = IPv4)
FCS (Frame Check Sequence): A CRC checksum in the trailer for error detection

The result is an Ethernet frame: [Ethernet Header] [IP Header] [TCP Header] [HTTP Data] [Ethernet Trailer]

Step 5 - Physical Layer Transmits Bits

The physical layer takes the entire frame - every byte of it - and converts it to the appropriate signal for the transmission medium. Over Ethernet cable, each bit becomes a specific voltage change. Over fiber, each bit becomes a light pulse. Over Wi-Fi, each bit becomes a modulated radio wave. The bits travel to the next network device (your router or switch).

Example: Visualizing the nested structure:
|<-------------- Ethernet Frame ---------------------------------->|
| Eth Header | IP Header | TCP Header | HTTP Data      | Eth Trail |
| 14 bytes   | 20 bytes  | 20 bytes   | Variable       | 4 bytes   |
|            |<-------- IP Packet ------------------->|             |
|            |           |<---- TCP Segment -------->|             |
|            |           |            |<-- App Data ->|             |
Each layer's header wraps everything from the layers above. The IP header does not know or care that the payload contains TCP and HTTP data - it treats the entire payload as opaque bytes to be delivered to the destination IP. The Ethernet header does not know or care about IP or TCP - it just delivers the frame to the next hop's MAC address.

Decapsulation - The Reverse Process

On the receiving machine, the exact reverse happens. Each layer strips its own header, reads the control information it needs, and passes the remaining data up to the layer above.

Physical layer receives electrical signals and converts them back to bits
Data Link layer reads the Ethernet header, verifies the FCS checksum, confirms the frame is addressed to this machine's MAC, strips the Ethernet header and trailer, and passes the IP packet up
Network layer reads the IP header, confirms the packet is addressed to this machine's IP, strips the IP header, and passes the TCP segment up
Transport layer reads the TCP header, uses the destination port number to identify which application should receive the data, handles acknowledgments and ordering, strips the TCP header, and passes the HTTP data up
Application layer receives the raw HTTP data and processes it - in this case, a web server parses the HTTP GET request and prepares a response

Important: Notice that at each hop along the route (your router, your ISP's router, intermediate routers, the destination's router), only Layers 1–3 are involved. Intermediate routers decapsulate and re-encapsulate the Ethernet frame (Layer 2 headers change at every hop because the MAC address changes), but they do not touch the TCP header or the HTTP data. The Transport and Application layers are end-to-end - they only exist on the sending and receiving machines, not on intermediate devices.

This is a crucial distinction: Layers 1–3 are hop-by-hop. Layers 4–7 are end-to-end.

What Changes at Each Hop

As a packet travels across the internet, it passes through multiple routers. At each router, the Layer 2 (Data Link) header is stripped and replaced, but the Layer 3 (Network) and Layer 4 (Transport) headers remain unchanged. Here is why:

The Ethernet header contains the MAC address of the next hop - the very next device the frame needs to reach. When your computer sends a frame to your home router, the destination MAC is your router's MAC. When your router forwards the packet to your ISP's router, it creates a new frame with the ISP router's MAC as the destination. The MAC addresses change at every hop.

The IP header contains the final destination's IP address. This does not change as the packet crosses routers (with rare exceptions like NAT). Every router along the path reads the destination IP to decide where to forward the packet next, but it does not modify it. The IP address is the "postal address" - it stays the same from origin to destination.

The TCP header is never touched by routers. Routers do not operate at Layer 4. They do not know or care about port numbers, sequence numbers, or acknowledgments. TCP is purely an end-to-end concern between the source and destination machines.

sequenceDiagram
    participant PC as Your Computer
    participant R1 as Home Router
    participant R2 as ISP Router
    participant SRV as Web Server

    Note over PC: Frame: MAC=Router1, IP=Server, TCP=Port80, HTTP=GET
    PC->>R1: Ethernet Frame (Your MAC → Router1 MAC)
    Note over R1: Strips Ethernet header<br/>Reads IP dest → forward to ISP<br/>New Ethernet header
    R1->>R2: Ethernet Frame (Router1 MAC → Router2 MAC)
    Note over R2: Strips Ethernet header<br/>Reads IP dest → forward to Server<br/>New Ethernet header
    R2->>SRV: Ethernet Frame (Router2 MAC → Server MAC)
    Note over SRV: Strips all headers<br/>Reads HTTP GET /index.html

This sequence diagram shows a packet traveling from your computer through a home router and ISP router to a web server. At each hop, the Ethernet frame header changes - the MAC addresses are updated to reflect the next hop - but the IP header and TCP header stay the same throughout the journey. Your computer sends a frame addressed to the home router's MAC. The home router strips the Ethernet header, reads the IP destination, creates a new frame addressed to the ISP router's MAC, and forwards it. The ISP router does the same, creating a new frame addressed to the web server's MAC. The web server receives the frame, strips all headers, and reads the HTTP GET request.

Encapsulation in Practice - What Wireshark Shows

When you capture a packet in Wireshark, you see encapsulation directly. Wireshark displays each layer as a collapsible section:

▸ Ethernet II, Src: aa:bb:cc:dd:ee:ff, Dst: 11:22:33:44:55:66
▸ Internet Protocol Version 4, Src: 192.168.1.42, Dst: 93.184.216.34
▸ Transmission Control Protocol, Src Port: 52431, Dst Port: 80
▸ Hypertext Transfer Protocol (GET /index.html)

Each section corresponds to one layer's header. The outermost (Ethernet) is Layer 2. The next (IP) is Layer 3. Then TCP is Layer 4. Finally HTTP is Layer 7. You can click on each section to see the individual header fields and the raw bytes they correspond to.

This is encapsulation made visible. Every time you look at a Wireshark capture, you are looking at nested headers - each one added by a different layer, each one serving a different purpose, each one read and stripped by the corresponding layer on the receiving end.

Interview: Encapsulation might seem like a purely academic concept, but it shows up in practical System Design discussions:

Q: "Why does a Layer 7 load balancer add latency compared to Layer 4?" Because an L7 load balancer must decapsulate all the way up to the Application layer (parse the HTTP request) before making a routing decision. An L4 load balancer only needs to read the IP and TCP headers - it never decapsulates past Layer 4.

Q: "What is the overhead of HTTPS compared to HTTP?" TLS adds an encryption layer between TCP and HTTP. This means additional encapsulation (TLS record headers), additional processing (encryption/decryption), and additional round trips (TLS handshake). Understanding encapsulation helps you reason about where the overhead comes from.

Q: "Why does MTU matter?" The Maximum Transmission Unit limits the total size of a frame at Layer 2. If the encapsulated packet (IP header + TCP header + application data) exceeds the MTU, the network layer must fragment the packet. Understanding encapsulation helps you see why adding headers at each layer eventually bumps into size limits.

What Comes Next

The next topic explores protocols - the rules that govern how each layer communicates. You have seen what each layer does and how they nest inside each other. Now we look at the specific protocols (TCP, IP, HTTP, Ethernet) that implement each layer's rules, and how those protocols interact with each other across the stack.

Exercise: Starter: Draw the encapsulation diagram from memory. Starting with HTTP data, add the TCP header, then the IP header, then the Ethernet header and trailer. Label each layer and name the PDU at each stage (Data → Segment → Packet → Frame → Bits). Do this without looking at the lesson - repetition builds the mental model.

Intermediate: Open Wireshark and capture any HTTP request. Click on the IP header in the capture. Find the "Total Length" field - this tells you the total size of the IP packet. Now click on the TCP header and note the header length. Subtract the IP header length and TCP header length from the IP total length. The remainder is the application data size. You have just manually decapsulated a packet.

Advanced: Research how VPN tunneling uses encapsulation within encapsulation. In a VPN tunnel, an already-encapsulated IP packet is treated as payload and encapsulated again with new IP and transport headers. Draw the full header structure of a packet traveling through a VPN - you should see two IP headers, two transport headers, and the original application data. Why does this double-encapsulation happen, and what are the performance implications?

Back to Computer Networking