CCNA online course

Data Encapsulation in the OSI Model

Learn how data moves through the OSI model as segments, packets, frames, and bits, including headers, trailers, addressing, routing, and decapsulation.

Data encapsulation is the process of adding protocol-specific control information to data as it moves down a network stack. This information allows devices to identify applications, deliver traffic to the correct host, route it between networks, detect errors, and transmit it over a particular medium.

At the receiving device, the reverse process is called decapsulation. Each layer examines and removes the information intended for that layer, then passes the remaining payload to the next higher layer.

Why Data Encapsulation Is Necessary

An application message by itself does not contain everything needed to deliver it across a network. Protocols add information such as:

• Application identification: Transport port numbers identify the destination service or application.
• Logical addressing: Source and destination IP addresses identify the endpoints across multiple networks.
• Local delivery information: Source and destination MAC addresses identify devices on the current data-link network.
• Reliability information: TCP can add sequence numbers, acknowledgment numbers, flags, window information, and checksums.
• Error detection: Ethernet adds a Frame Check Sequence, or FCS, to detect corruption on a link.
• Sequencing and flow control: Transport protocols can organize data and regulate how much traffic is sent.
• Media-access details: The physical and data-link layers define how information is represented and placed on a medium.

The original message is the application data. Headers and trailers are control information added by networking protocols. A header is normally placed before a payload. A trailer is appended after it. The resulting combination is a protocol data unit, or PDU.

OSI Model Layers and Encapsulation

The Open Systems Interconnection (OSI) model divides network functions into seven conceptual layers:

1. Layer 7: Application
2. Layer 6: Presentation
3. Layer 5: Session
4. Layer 4: Transport
5. Layer 3: Network
6. Layer 2: Data Link
7. Layer 1: Physical

The upper layers prepare and represent application information. The lower layers package that information for delivery between devices and across physical media. The OSI model is a framework for understanding responsibilities; real implementations do not always separate every function exactly as the model does.

In the TCP/IP model, the OSI Application, Presentation, and Session layers are commonly grouped into the application layer. The OSI Transport layer maps to the TCP/IP transport layer, the OSI Network layer maps to the internet layer, and the OSI Data Link and Physical layers are commonly grouped into the network access layer.

Protocols such as HTTP, TCP, IP, Ethernet, and Wi-Fi are often discussed using both models. The mapping is useful, but it is not always exclusive or exact. For example, application protocols can use several services, and some technologies perform functions associated with more than one OSI layer.

For a broader layer-by-layer review, see the OSI reference model.

Protocol Data Units by Layer

A protocol data unit (PDU) is the information handled by a particular protocol layer. The commonly taught names are:

Terminology can vary by protocol and vendor. TCP creates segments. UDP is commonly described as creating datagrams. The word datagram can also be used in some contexts for an IP packet. At Layers 7 through 5, data is the most common general PDU name.

The basic transformation is:

Application data
        ↓
TCP segment or UDP datagram
        ↓
IP packet
        ↓
Ethernet or Wi-Fi frame
        ↓
Bits represented as signals

Payloads and Nested Headers

A payload is the data carried inside a protocol unit. A complete higher-layer PDU becomes the payload of the next lower-layer PDU.

Ethernet header | IP header | TCP header | Application data | Ethernet FCS

In this example, the application data is the TCP payload. The entire TCP segment, including its TCP header and application data, is the payload of the IP packet. The entire IP packet is the payload of the Ethernet frame. The Ethernet FCS is a trailer rather than a payload.

The same bytes can therefore have different descriptions depending on the layer examining them. An IP packet sees a TCP segment as its payload. Ethernet sees the entire IP packet as its payload. This nesting is the central idea behind encapsulation.

Transport-Layer Encapsulation

At Layer 4, TCP or UDP adds a transport header to application data. Source and destination port numbers identify the applications or services involved. A source port is commonly selected by the client, while the destination port identifies the service, such as HTTP on port 80 or HTTPS on port 443. Port numbers are meaningful to the transport layer, not to Ethernet.

TCP segments

TCP is connection-oriented and provides reliability features. A TCP header can include:

• Source and destination ports: Identify the communicating applications.
• Sequence number: Helps order bytes and identify the position of data in the stream.
• Acknowledgment number: Indicates the next sequence position the receiver expects.
• Flags: Indicate control states and actions, such as connection setup, acknowledgment, or termination.
• Window information: Supports flow control by indicating how much additional data the receiver can accept.
• Checksum: Helps detect errors in the TCP header and data.

TCP can retransmit missing data, deliver the byte stream in order, and regulate transmission. These functions add overhead but support reliable communication.

UDP datagrams

UDP is connectionless and has a smaller header. It includes source and destination ports, a length field, and a checksum. UDP does not establish a connection or provide TCP-style sequencing, acknowledgments, retransmission, or window-based flow control. This lower overhead can be useful for DNS queries, voice, video, and applications that implement their own timing or recovery behavior.

Both TCP and UDP PDUs can be carried inside IP packets and Ethernet or Wi-Fi frames. Their different headers provide different delivery behavior.

Network-Layer Encapsulation

At Layer 3, IP adds a network-layer header around the transport PDU. The header contains a source IP address and a destination IP address. These are logical addresses used to identify endpoints and make routing decisions across networks.

IPv4 headers include concepts such as:

• Time to Live (TTL): A value reduced by routers. If it reaches zero, the packet is discarded, preventing indefinite circulation.
• Protocol field: Identifies the next encapsulated protocol, such as TCP or UDP.
• Fragmentation information: Fields that support handling packets that are too large for a link, where fragmentation is applicable.
• Header checksum: Detects errors in the IPv4 header. Routers recalculate it when the TTL changes.

IPv6 uses a Hop Limit instead of IPv4 TTL and does not use an IPv4-style header checksum. Both IPv4 and IPv6 provide logical addressing and support forwarding decisions.

Logical IP addressing differs from local physical addressing. An IP address identifies the end-to-end source and destination in a routed communication. A MAC address identifies delivery on the current local link. A router examines the destination IP address to choose a route and a next hop, meaning the next device to which it sends the packet.

Data-Link-Layer Encapsulation

The data-link layer places the Layer 3 packet into a frame suitable for a local network. An Ethernet frame commonly includes:

• Destination MAC address: The local device that should receive the frame on this link.
• Source MAC address: The interface sending the frame on this link.
• EtherType: Identifies the encapsulated Layer 3 protocol, such as IPv4 or IPv6.
• Payload: The IP packet.
• Frame Check Sequence (FCS): A trailer used to detect corruption.

Ethernet has a frame header and a frame trailer. The MAC addresses and EtherType are in the header. The FCS is in the trailer. Length information may be used in related data-link formats; Ethernet commonly uses EtherType to identify the payload protocol.

The FCS allows a receiving interface to check whether the frame was damaged in transit. If the calculated result does not match the received FCS, the frame is treated as corrupted and is normally discarded before higher-layer processing.

MAC addresses support local-link delivery. When a router forwards a packet to another network, the outgoing frame normally has new source and destination MAC addresses. IP addresses generally remain the same from the original host toward the destination, subject to technologies such as address translation.

Physical-Layer Transmission

The physical layer converts the frame into a sequence of bits and represents those bits as signals. Depending on the medium, the signals may be:

• Electrical signals on copper cabling
• Optical pulses on fiber
• Radio signals over a wireless link

The physical layer does not interpret IP addresses, TCP or UDP port numbers, or application content. It transmits and receives the physical representation of the data. Interpretation begins at higher layers after the receiving interface reconstructs the frame.

Decapsulation at the Receiving Host

A receiving host processes the transmission in the reverse direction:

1. The physical layer receives signals and reconstructs bits.
2. The data-link layer recognizes the frame, checks the destination MAC address, and verifies the FCS.
3. The data-link header and trailer are removed after successful validation.
4. The network layer examines the IP packet and confirms that the destination IP address belongs to the host or that forwarding is appropriate on a router.
5. The IP header identifies the next protocol, such as TCP or UDP.
6. The transport layer examines the destination port and delivers the data to the matching application or service.
7. The upper layers process the application data and present it to the software that requested it.

Each layer removes and interprets its own relevant control information. The payload passed upward is the remaining higher-layer PDU. Destination MAC, destination IP, the protocol identifier, and the destination port work together to deliver the information to the correct interface, host, protocol, and application.

Encapsulation Across Switches and Routers

Layer 2 switch forwarding

A Layer 2 switch forwards Ethernet frames within a LAN using destination MAC addresses. It learns source MAC addresses and the ports where those addresses were observed, building a MAC address table.

When two hosts are in the same subnet, the sender normally places the destination host's MAC address in the Ethernet frame. The switch uses its MAC address table to select the outgoing port. The switch does not normally rewrite the Ethernet header merely because it forwards the frame.

Router forwarding

A router handles the boundary between local links and routed networks. It receives the incoming frame, checks the Layer 2 information, removes the incoming Ethernet header and FCS trailer, and examines the IP packet. The router then selects a route based on the destination IP address, reduces the IPv4 TTL or IPv6 Hop Limit, and creates a new Layer 2 frame for the next link.

The new frame has a new source MAC address, normally belonging to the router's outgoing interface, and a new destination MAC address, normally belonging to the next hop. The router sends the new frame as bits on the outgoing medium.

IP addressing is therefore generally end-to-end, while Ethernet addressing is hop-by-hop. The exact details can differ with other Layer 2 technologies, tunnels, wireless links, or address translation, but this distinction is essential for CCNA fundamentals.

Example: HTTP Request to a Remote Web Server

Suppose a client sends an HTTP request to a web server on another network. HTTPS commonly uses destination TCP port 443; plain HTTP commonly uses port 80.

1. The web browser creates an HTTP request. This is application data.
2. TCP adds a source port, destination port, sequence information, flags, window information, and a checksum. The result is a TCP segment.
3. IP adds the client's source IP address and the server's destination IP address. The result is an IP packet.
4. Because the server is remote, the client sends the packet to its default gateway. Ethernet adds the client's MAC address as the source MAC and the gateway interface's MAC address as the destination MAC.
5. The Ethernet frame is converted to bits and transmitted.
6. The router removes the incoming Ethernet encapsulation, examines the destination IP address, reduces TTL, and selects the next hop.
7. The router creates a new outgoing frame with new source and destination MAC addresses and a newly calculated FCS.
8. After the packet reaches the server's local network, the final frame uses the server's MAC address as its destination.
9. The server decapsulates the frame, packet, and segment, then delivers the HTTP data to the web service listening on the destination port.

Client application data
  → TCP segment: client-port → 443
  → IP packet: client-IP → server-IP
  → Ethernet frame: client-MAC → default-gateway-MAC
  → bits on the local medium

Example: Two Devices on the Same Ethernet LAN

If two hosts are in the same subnet, the sender uses the destination host's MAC address in the Ethernet frame. The IP packet still contains the source and destination IP addresses of the two hosts.

A switch examines the destination MAC address and forwards the frame through the appropriate port. No router is required for this local delivery, and the Ethernet header is not rewritten simply because the switch forwards the frame.

Example: TCP Compared with UDP

An HTTPS session can use TCP, while a DNS query commonly uses UDP. Both transport PDUs can be encapsulated in IP packets and Ethernet frames:

Ethernet header | IP header | TCP header | HTTPS data | FCS
Ethernet header | IP header | UDP header | DNS data   | FCS

The outer encapsulation is similar, but the transport headers and delivery behavior differ. TCP provides connection-oriented reliability and ordering. UDP has lower overhead and does not provide TCP's built-in reliability features.

Reading Encapsulation in a Packet Capture

A conceptual capture might display the following nested structure:

• Ethernet header: Source MAC, destination MAC, and EtherType.
• IP header: Source IP, destination IP, TTL or Hop Limit, and the next-protocol identifier.
• TCP or UDP header: Source port, destination port, and transport-specific control fields.
• Application payload: HTTP, DNS, or another application protocol's information.
• Ethernet FCS: Error-detection trailer, when captured and exposed by the interface.

Wireshark can show this hierarchy directly. Expanding each protocol lets you see which fields belong to which layer and how a higher-layer PDU is labeled as the lower layer's payload.

Useful Cisco IOS and Diagnostic Commands

For related Cisco interface and routing practice, see Configure OSPF and computer network fundamentals.

Troubleshooting with Encapsulation Concepts

Local access works, but remote networks are unreachable

This often means local Ethernet encapsulation works while Layer 3 configuration or routing does not. Check the host IP address and subnet mask, verify the default gateway, inspect ARP resolution for the gateway MAC address, and verify router interfaces and routing information.

FCS or CRC errors increase on a switch interface

Frames may be corrupted on the physical link before higher-layer decapsulation can occur. Inspect interface error counters and check cabling, transceivers, speed and duplex settings, and possible physical interference.

IP addresses are correct, but the application does not receive traffic

Layer 3 delivery may work while Layer 4 or the application fails. Verify the destination TCP or UDP port, confirm that the service is listening, check ACLs and host firewalls, and inspect TCP flags or UDP responses in a packet capture.

Frames leave the host, but no remote reply arrives

The first-hop MAC address may be correct while the packet fails at an intermediate router or on the return path. Use traceroute or tracert to identify the last responding Layer 3 hop. Confirm routes in both directions and check for TTL expiration, ACL filtering, or NAT-related issues where applicable.

Exam-Relevant Summary

• Encapsulation adds headers and, where applicable, trailers as data moves down the stack.
• Decapsulation removes and interprets those additions as data moves up the receiving stack.
• Layers 7 through 5 commonly refer to their PDU as data.
• TCP creates segments; UDP commonly creates datagrams.
• IP creates packets and supplies logical source and destination addresses.
• Ethernet creates frames and supplies local-link MAC addresses.
• The physical layer transmits bits as electrical, optical, or radio signals.
• An entire higher-layer PDU becomes the payload of the next lower layer.
• A switch forwards frames using MAC addresses and normally preserves the Ethernet header.
• A router removes the incoming Layer 2 encapsulation and creates new Layer 2 encapsulation for the next hop.
• IP addresses and transport ports are generally preserved end-to-end, while MAC addresses and Ethernet FCS values change at each routed hop.
• Routers reduce IPv4 TTL or IPv6 Hop Limit.