VMware ESXi and vSphere Cluster Management

Data Encapsulation in the OSI Model

Learn how data moves through the seven OSI layers using encapsulation and decapsulation, including headers, trailers, PDUs, frames, packets, segments, and bits.

When a device sends information across a network, the information does not travel as one unstructured block. Each networking layer adds information needed to deliver, identify, check, or process the data. This process is called encapsulation. At the receiving endpoint, the reverse process is called decapsulation.

This lesson follows a web request from an application down through the OSI model, then back up the model at the destination. It also explains protocol data units (PDUs), headers, trailers, Ethernet delivery, and what changes when a packet crosses a router.

What Is Encapsulation?

Encapsulation is the process in which a lower networking layer adds protocol control information around data received from a higher layer. The added information helps the receiving protocol understand what the data is, where it should go, how it should be ordered, and whether it was damaged.

At the sending host, encapsulation occurs as data moves downward through the protocol stack. Each layer receives the complete output of the layer above it and treats that output as its own payload.

• Addressing: identifies a destination or the next local recipient.
• Delivery: helps move information through a local link or across interconnected networks.
• Protocol identification: indicates which upper-layer protocol should process the payload.
• Sequencing and reliability: can support ordering, acknowledgments, or recovery when a protocol provides those functions.
• Error detection: allows a receiver to detect corruption.
• Local-link handling: supplies information needed to transmit a unit over a particular medium, such as Ethernet.

How Adjacent OSI Layers Work Together

Each OSI layer uses services supplied by the layer below it and provides services to the layer above it. For example, the Transport layer uses Network-layer delivery, while the Network layer uses Data Link-layer delivery for each local hop.

Suppose the Transport layer creates a segment. The Network layer does not treat the segment as separate from the application content. It treats the entire segment, including its Transport header and payload, as its own payload. The Network layer then adds its own header and produces a packet.

Layers also communicate logically with their peer layers. A Transport protocol on one endpoint follows rules intended to work with the peer Transport protocol on the other endpoint. However, the actual bits do not jump directly from one peer layer to the other inside a single host. They move downward through the sender's stack, across the medium, and upward through the receiver's stack.

Headers, Trailers, and Payloads

Headers

A header is control information placed before a payload. Headers commonly identify addresses, protocols, ports, sequence information, lengths, or other values required by the layer.

Trailers

A trailer is control information placed after a payload. Trailers are not required at every layer. The Data Link layer is the usual OSI layer associated with adding both a header and a trailer.

In an Ethernet example, the trailer contains a frame check sequence (FCS). The FCS is an error-detection value calculated from the frame. The receiver calculates or checks the corresponding value and can discard a frame whose contents appear corrupted.

Do not assume that every OSI layer adds both a header and a trailer. Headers are common during encapsulation, while trailers are associated with particular protocols and functions.

Protocol Data Units (PDUs)

A protocol data unit (PDU) is the unit of information processed at a particular protocol layer. It includes that layer's relevant control information and the encapsulated content received from upper layers.

PDU is a generic term. A Layer 3 PDU means the unit processed at Layer 3, regardless of whether a particular resource calls it a packet or uses another protocol-specific name. OSI numbering starts at the Physical layer:

• Layer 1 is the Physical layer.
• Layer 2 is the Data Link layer.
• Layer 3 is the Network layer.
• Layer 4 is the Transport layer.
• Layers 5 through 7 are Session, Presentation, and Application.

Common names such as segment, datagram, packet, and frame are useful shortcuts, but terminology can vary by protocol, vendor, and learning resource. Understanding the layer's function is more important than memorizing one label in isolation.

OSI Layers and Common PDU Names

Layers 7, 6, and 5 are often collectively described as carrying data. At Layer 4, TCP commonly produces a segment and UDP commonly produces a datagram. Layer 3 commonly produces a packet, Layer 2 produces a frame, and Layer 1 transmits bits or signals.

Sender-Side Encapsulation Sequence

Consider a browser sending an HTTP request over an Ethernet LAN. The exact implementation can involve additional protocols and processing, but the common sequence is:

1. The Application layer creates application data, such as an HTTP request.
2. The Transport layer adds a TCP header containing information such as source and destination port numbers and sequencing information. The result is a TCP segment.
3. The Network layer adds an IP header containing source and destination IP addresses and other network-layer fields. The result is an IP packet whose payload is the TCP segment.
4. The Data Link layer adds an Ethernet header containing local-link information, including source and destination MAC addresses. It also adds an Ethernet trailer containing the FCS. The result is an Ethernet frame.
5. The Physical layer converts the frame into bits and signals transmitted over copper, fiber, or wireless media.

Application data
    + TCP header                         = TCP segment
    + IP header                          = IP packet
    + Ethernet header + FCS trailer      = Ethernet frame
    converted to bits and signals        = Physical transmission

Nested PDU Anatomy

Each lower-layer unit carries the complete unit created by the layer above it. In simplified form, the nesting looks like this:

Ethernet frame
  [Ethernet header]
    [IP packet
      [IP header]
        [TCP segment
          [TCP header]
            [application data]
        ]
    ]
  [FCS trailer]

The TCP segment is the payload of the IP packet. The IP packet is the payload of the Ethernet frame. This nesting explains why a packet capture can show an Ethernet frame containing an IP packet containing a TCP segment and application data.

Header and Trailer Placement in an Ethernet Delivery Example

Receiver-Side Decapsulation Sequence

Decapsulation is the reverse process at the receiving endpoint. Received signals are interpreted as bits, the bits are used to reconstruct a frame, and the data then moves upward through the protocol stack.

1. The Physical layer receives signals and presents the resulting bits to the Data Link layer.
2. The Data Link layer reconstructs and validates the frame. It examines local-link information and the FCS, then removes or processes the Ethernet encapsulation before passing the IP packet upward.
3. The Network layer examines the IP header, determines whether the packet is for the host, and passes the Transport-layer content upward.
4. The Transport layer examines its header, uses port and control information, and delivers the application data to the correct process.
5. The upper layers interpret, transform, or present the application data.

Each receiving layer examines information intended for that layer and removes or processes its own control information before passing the remaining payload upward. A damaged Ethernet frame may be discarded at Layer 2, so its upper-layer payload never reaches the Network or Transport layer.

Encapsulation Across a LAN

On a local Ethernet network, the sender places an IP packet inside an Ethernet frame. The Ethernet frame is used for delivery across the current local link, while the IP packet carries logical network-layer addressing for delivery across interconnected networks.

A MAC address is a Data Link-layer address used on the local segment. An IP address is a Network-layer address used for logical delivery and routing. These addresses solve different problems:

• The destination MAC address identifies the local recipient of the Ethernet frame on the current link, which might be the final host or a router's interface.
• The destination IP address identifies the logical destination of the packet, which may be on a remote network.

For a remote destination, the sender normally sends the Ethernet frame to the MAC address of its default gateway. The packet inside the frame still has the remote destination IP address.

What Happens at a Router?

A router accepts an incoming Layer 2 frame, validates and removes the incoming Data Link encapsulation, and examines the Layer 3 packet. It uses the destination IP address and its routing information to select an outgoing interface.

The router then creates a new Layer 2 frame appropriate for the outgoing link. Therefore, the Ethernet frame received on one LAN is generally not forwarded unchanged onto another LAN.

• Source and destination MAC addresses normally change at each routed hop.
• The Layer 3 IP packet is forwarded, although fields such as the IPv4 TTL or IPv6 Hop Limit are changed as part of routing.
• The Transport segment or datagram normally remains inside the IP packet and is forwarded end to end, unless a network function alters or terminates it.

LAN A:  Frame A [MAC A1 -> Router MAC A] [IP packet]
Router: removes Frame A, routes the IP packet, creates Frame B
LAN B:  Frame B [Router MAC B -> MAC B1] [same forwarded IP packet]

Encapsulation and Decapsulation Direction

OSI and TCP/IP Terminology

TCP/IP teaching commonly uses segment, packet, and frame as familiar names for units associated with Transport, Network, and Data Link functions. OSI discussions may instead use generic terms such as Layer 4 PDU or Layer 3 PDU.

This is a vocabulary comparison, not a claim that the OSI and TCP/IP models are identical. The models organize networking functions differently. In practice, remember the relationship: TCP commonly produces a segment, IP commonly produces a packet, Ethernet commonly produces a frame, and the Physical layer transmits bits or signals.

Troubleshooting with Encapsulation Awareness

Local resources work, but remote networks do not

If a user can access local resources but cannot reach a remote network, local Layer 2 delivery may be working while Layer 3 addressing, routing, or the default gateway is incorrect. Check whether the host has a suitable IP address, subnet configuration, and gateway, then consider the routing path.

Frame or CRC errors appear on an interface

Frame errors and CRC-related errors point toward Data Link frame validation. The FCS is used to detect corruption. A corrupt frame can be discarded before upper-layer protocols receive its payload, so the problem may appear to an application as packet loss or poor performance.

A capture shows nested units

In a packet capture, identify the outer Ethernet frame, the IP packet inside it, the TCP segment or UDP datagram inside the packet, and the application payload inside the transport PDU. This is a direct view of encapsulation.

A learner expects one Ethernet frame across multiple LANs

Correct this misconception by remembering that a router decapsulates the incoming Layer 2 frame and re-encapsulates the packet in a new frame for the outgoing link. Layer 2 addressing is local to each link; Layer 3 addressing supports delivery across networks.

Exam-Relevant Summary

• Encapsulation adds layer-specific control information as data moves down the sender's stack.
• Decapsulation processes and removes that information as data moves up the receiver's stack.
• A payload is the upper-layer content carried by a lower-layer PDU.
• A header appears before a payload; a trailer appears after a payload.
• The Data Link layer commonly adds both a frame header and a trailer such as an Ethernet FCS.
• Layer 4 commonly uses segment for TCP and datagram for UDP.
• Layer 3 commonly uses packet, Layer 2 uses frame, and Layer 1 uses bits or signals.
• MAC addresses provide local-link delivery; IP addresses provide logical network delivery and routing.
• A router normally replaces the Layer 2 frame at each hop while forwarding the Layer 3 packet.
• PDU is the generic term; protocol-specific names are useful but are not perfectly universal.

For a broader foundation, review the OSI data encapsulation overview alongside your study of Ethernet, IP addressing, and routing.