CCNA online course

Data Encapsulation in Networking

Learn how data is encapsulated and decapsulated through the OSI and TCP/IP models, including TCP, IP, Ethernet, addressing, routing, MTU, and troubleshooting.

Data encapsulation is the process of adding protocol information to application data as it moves down a networking stack. The receiving device performs decapsulation: it removes and interprets that information as the data moves back up the stack.

This process allows applications, hosts, switches, routers, and physical media to work together without every component needing to understand the entire communication. Each layer performs a defined job, adds a header or trailer when necessary, and passes its resulting protocol data unit (PDU) to the next layer.

What Data Encapsulation Accomplishes

Application data is not ready to travel directly across a network. It needs information that identifies the application, provides delivery control, identifies the source and destination, selects a next hop, and detects transmission errors. Different layers add different control information for these purposes.

• Protocol interoperability: Standard headers and rules allow equipment and software from different vendors to communicate.
• Application delivery: Port numbers identify the destination process, such as a web service listening on TCP port 443.
• Logical delivery: IP addresses identify source and destination hosts across interconnected networks.
• Local-link delivery: MAC addresses identify interfaces on the current Ethernet or other data-link network.
• Error detection: Checksums and the Ethernet Frame Check Sequence help detect corruption.
• Flow and reliability control: TCP can use sequence numbers, acknowledgments, flags, windows, and retransmissions.

Layering also limits responsibility. A switch normally examines a frame's Layer 2 information, while a router examines the Layer 3 packet to make a forwarding decision. An endpoint eventually processes transport and application information.

OSI Layers, TCP/IP Layers, and Protocol Data Units

The seven-layer OSI model is a reference model. The TCP/IP model groups some OSI layers together because Internet protocols commonly implement their functions as a combined layer.

In everyday networking language, people often use “data” for an application payload, “packet” for an IP PDU, and “frame” for a Layer 2 PDU. Strictly speaking, a packet can contain a transport segment or datagram, and the complete Layer 2 frame contains that packet as its payload.

For a broader model comparison, see the OSI Reference Model.

Sender-Side Encapsulation

1. The application creates data, such as an HTTPS request.
2. The transport layer adds a TCP or UDP header. The result is a segment or datagram.
3. The Internet layer adds an IPv4 or IPv6 header. The result is an IP packet.
4. The network-access layer adds a link header and usually a trailer. The result is a frame.
5. The physical layer converts the frame into bits and signals suitable for the medium.

At every stage, the previous PDU becomes the next layer's payload. A simplified Ethernet transmission therefore looks like this:

Application data
  + TCP header                         = TCP segment
  + IPv4 or IPv6 header                = IP packet
  + Ethernet header + FCS trailer      = Ethernet frame
  converted to electrical, optical,
  or radio signals                     = transmitted bits

Receiver-Side Decapsulation

The destination reverses the process. Its network interface receives and checks the physical signal, reconstructs a frame, verifies the data-link information, and passes the packet upward. The IP layer checks the destination address and protocol field, then passes the payload to TCP, UDP, ICMP, or another indicated protocol. The transport layer uses the port and transport controls to deliver data to the correct application.

• A switch generally examines Layer 2 information needed to forward a frame.
• A router removes the incoming Layer 2 frame, examines the Layer 3 packet, and builds a new Layer 2 frame for the next link.
• A destination host decapsulates all relevant layers until the application receives its original data.

Intermediate devices do not normally remove the TCP or UDP header merely because they forward the packet. They inspect only the information required for their role, although firewalls, NAT devices, load balancers, and other higher-layer devices may inspect or modify additional information.

Encapsulation Information Added at Each Layer

Layer 4 Encapsulation: TCP and UDP

TCP segments

TCP provides connection-oriented, reliable byte-stream delivery. Its header includes source and destination port numbers, sequence and acknowledgment numbers, flags, a receive window, and a checksum. Options can add capabilities such as negotiated maximum segment size or timestamps.

• Ports: Identify the sending and receiving applications or services.
• Sequence numbers: Identify the position of transmitted bytes.
• Acknowledgments: Tell the sender which data has been received.
• Flags: Support connection setup, shutdown, acknowledgment, and other control functions.
• Window: Supports flow control by limiting unacknowledged data.
• Checksum: Detects corruption in the TCP segment and its related addressing information.

UDP datagrams

UDP is connectionless and has a smaller header. It contains source and destination ports, a length, and a checksum. UDP does not provide TCP's sequencing, acknowledgments, retransmission, or connection-management behavior. Applications choose UDP when low overhead, timeliness, or application-managed reliability is preferred.

Port numbers enable multiplexing: many applications share one host's IP connection. At the receiver, demultiplexing uses the destination port and other header information to deliver each PDU to the correct socket. HTTPS commonly uses destination TCP port 443; DNS may use UDP or TCP port 53.

Layer 3 Encapsulation: IP Packets

The Internet layer adds an IP header. IPv4 and IPv6 perform logical addressing and routing, but their header formats differ.

• Source and destination IP addresses: Identify the communicating endpoints.
• Protocol or Next Header: Identifies the payload protocol, such as TCP, UDP, or ICMP.
• TTL or Hop Limit: Is reduced by each router. When it reaches zero, the packet is discarded to prevent indefinite circulation.
• Packet length and fragmentation information: IPv4 supports fragmentation fields in its base header; IPv6 normally relies on the source and extension headers for fragmentation.

Routers use the destination IP address and their routing table to select an outgoing interface or next hop. The source and destination IP addresses normally remain end-to-end values during ordinary routing. A NAT device is an important exception because it can translate addresses and ports.

MTU and fragmentation

The Maximum Transmission Unit (MTU) is the largest Layer 3 packet that a link can carry in one frame payload. If a packet is too large for a path, IPv4 may fragment it when permitted. IPv6 routers do not fragment packets; the source must learn a suitable size and send fragments when required.

Fragmentation creates extra processing and loss sensitivity because losing one fragment can prevent reassembly of the whole packet. TCP commonly avoids IP fragmentation by using a negotiated Maximum Segment Size (MSS), which limits the TCP payload so the resulting IP packet fits the path MTU.

Layer 2 Encapsulation: Frames

Data-link protocols package an IP packet inside a frame for one local link. Ethernet is common on wired networks, but Wi-Fi and WAN protocols use different frame formats.

• Destination MAC address: Identifies the interface that should receive the frame on the current link.
• Source MAC address: Identifies the interface that transmitted the frame.
• EtherType or length: Identifies the carried protocol or the payload length. An EtherType can identify IPv4, IPv6, or another protocol.
• 802.1Q VLAN tag: Adds VLAN identification and priority information, normally on tagged trunk links.
• Frame Check Sequence (FCS): A trailer containing a CRC-based value used to detect errors in the frame.

MAC addressing is local-link addressing, not end-to-end addressing. Ethernet switches learn source MAC addresses and use their MAC address table to forward frames toward known destinations within a VLAN.

ARP and Neighbor Discovery

When a host knows an IPv4 destination address but needs the next-hop MAC address, it uses ARP. IPv6 uses Neighbor Discovery, which operates through ICMPv6. For a remote destination, the host resolves the MAC address of its default gateway, not the MAC address of the remote server.

Layer 1: Bits and Signals

The physical layer transmits the frame as bits represented by signals. Copper uses electrical characteristics, fiber uses light, and wireless uses radio. Encoding, modulation, timing, and synchronization depend on the physical technology.

“Bits” describes the Layer 1 PDU in the OSI teaching model. The actual medium carries physical signals that represent those bits; bits are not themselves electrical voltage, light, or radio waves.

Addressing at Multiple Layers

End-to-End Versus Hop-by-Hop Fields

Encapsulation Across a Routed Network

Consider a client requesting an HTTPS page from a server on another network.

1. The browser creates an HTTPS request. Encryption and formatting occur at the application-related layers.
2. TCP adds a temporary client source port and destination port 443.
3. IP adds the client's source IP and the server's destination IP. TCP is identified in the IP protocol or Next Header field.
4. Because the server is remote, the client creates an Ethernet frame addressed to the default gateway's MAC address. The source MAC is the client's MAC address.
5. The switch forwards the frame using its destination MAC address and VLAN context.
6. The router validates the incoming frame, removes it, examines the IP packet, decrements TTL or Hop Limit, and performs a route lookup.
7. The router creates a new frame for the next link. Its outgoing source and destination MAC addresses are different from those on the previous link. The IP packet remains the routed payload, subject to required header updates.
8. After the final router, the destination host receives a frame addressed to its local MAC address and decapsulates it through IP, TCP, and the application.

The same IP packet can therefore travel inside multiple different Layer 2 frames. Ethernet may carry it on one link, Wi-Fi on another, and PPP across a point-to-point WAN. Layer 2 changes per hop; the Layer 3 packet provides the end-to-end routing context.

Same-Subnet Communication

If two hosts are on the same IP subnet, the sender resolves the destination host's MAC address with ARP or Neighbor Discovery. It sends a frame directly to that MAC address. A switch forwards the frame using its MAC address table, and no router is required.

There is no Layer 3 rewrite merely because a switch forwards the frame. The source and destination IP addresses remain the host addresses, and the source and destination MAC addresses remain those of the two local interfaces.

Ping and ICMP Encapsulation

A ping uses ICMP, not TCP or UDP. ICMP is identified directly in the IP header's protocol field for IPv4 or the IPv6 Next Header field. The packet still requires Layer 2 addressing on every link.

1. The source checks whether the target is local or remote.
2. It uses ARP for IPv4 or Neighbor Discovery for IPv6 to resolve the next-hop MAC address.
3. ICMP echo data is placed directly inside an IP packet.
4. Each router replaces the Layer 2 frame and reduces TTL or Hop Limit.
5. The destination decapsulates the frame and returns an ICMP echo reply.

Successful ping proves that ICMP can reach the target and return, but it does not prove that a particular TCP or UDP service is available.

Common Encapsulation Formats

The Layer 2 format can vary while the encapsulated IP packet remains usable. This separation is one of the main benefits of layered protocol design.

For related VLAN configuration concepts, see Configure Trunk Ports and Configure Router on a Stick.

Encapsulation Overhead, MTU, and MSS

Every header and trailer consumes bytes. For a basic Ethernet frame carrying IPv4 and TCP, approximate overhead includes the Ethernet header, IPv4 header, TCP header, and Ethernet FCS. Actual values vary when TCP options, IPv4 options, IPv6 extension headers, VLAN tags, or other features are present.

For example, with a 1,500-byte Ethernet MTU, a TCP connection commonly uses an MSS near 1,460 bytes when the IPv4 and TCP headers total 40 bytes. IPv6 commonly has a 1,280-byte minimum link MTU requirement and a 40-byte base IP header, so its ordinary TCP MSS calculation differs on a given link.

• VLAN tagging: Adds a tag to the Ethernet frame and may require compatible link MTU settings.
• VPNs and tunnels: Add outer headers, reducing the space available for the original packet.
• Segmentation: TCP can send smaller segments so packets fit the path.
• Fragmentation: IP may split a packet when permitted, but it adds complexity and can expose path-MTU problems.

Packet Capture Interpretation

A packet capture shows the nested protocol information directly. A typical HTTPS packet can be read from the outside inward:

1. Ethernet: inspect source MAC, destination MAC, EtherType, VLAN information, and FCS when captured.
2. IPv4 or IPv6: inspect source and destination IP, protocol or Next Header, packet length, and TTL or Hop Limit.
3. TCP or UDP: inspect source and destination ports, then TCP flags, sequence values, acknowledgments, or the UDP length.
4. Application payload: identify the data carried by the transport protocol. HTTPS payload is encrypted, so its contents are not normally readable without appropriate session keys.

Useful Wireshark filters include:

eth
ip
ipv6
tcp
udp
icmp
arp

Useful command-line captures include:

tcpdump -n -e
tcpdump -n -i <interface> host <address>

In a capture, do not call every unit a packet. The outer Ethernet unit is a frame, the IP unit is a packet, and the TCP unit inside it is a segment. UDP uses the term datagram.

Commands for Encapsulation Troubleshooting

Troubleshooting by Encapsulation Layer

Local devices work, but remote networks do not

Confirm that the destination is considered remote, the default gateway is correct, and the gateway's MAC address is resolved through ARP or Neighbor Discovery. Then verify the router's interface, route lookup, and forwarding path.

Two hosts on the same subnet cannot communicate

Check physical link status, VLAN membership, switch-port status, MAC address learning, IP subnet settings, and ARP or Neighbor Discovery entries. A same-subnet failure is often a Layer 1 or Layer 2 problem rather than a routing problem.

Ping succeeds, but a service is unreachable

Ping uses ICMP, while the service may require TCP or UDP. Check the destination port, transport protocol, listening process, access-control rules, and any firewall filtering.

Large transfers fail while small packets work

Investigate path MTU, interface MTU, TCP MSS, fragmentation restrictions, and extra VPN or tunnel headers. A successful small ping does not guarantee that large packets can cross the path.

A router receives traffic but does not continue it

Verify the incoming interface, route lookup, outgoing interface, next-hop neighbor resolution, TTL or Hop Limit behavior, and creation of the correct outgoing Layer 2 frame.

Practical Layer-by-Layer Checklist

1. Layer 1: Is there a carrier signal, an active interface, and a usable medium?
2. Layer 2: Is the correct VLAN active, is the destination MAC learned or resolved, and are FCS errors present?
3. Layer 3: Are the IP addresses, subnet masks or prefixes, default gateway, routes, TTL, and MTU correct?
4. Layer 4: Is the expected TCP or UDP port open, and are transport packets being acknowledged or rejected?
5. Application: Is the service running, does name resolution work, and can the application interpret the payload?

Key Exam Notes

• TCP produces a segment; UDP produces a datagram.
• IP produces a packet; Ethernet produces a frame.
• The destination MAC for remote traffic is normally the default gateway's MAC, not the remote host's MAC.
• Routers remove and replace Layer 2 headers and trailers at every routed hop.
• End-to-end IP addresses normally stay the same through routing, while MAC addresses change per link.
• TTL in IPv4 and Hop Limit in IPv6 decrease at each router.
• ICMP is carried directly inside IP, not inside TCP or UDP.
• FCS detects errors in a received data-link frame; it does not provide end-to-end application reliability.
• MTU limits the IP packet size a link can carry, while MSS limits the TCP payload size.
• Encapsulation adds headers and sometimes trailers; decapsulation removes and processes them in reverse order.