VMware ESXi and vSphere Cluster Management

Data Encapsulation and Decapsulation in TCP/IP Networking

Learn how TCP/IP layers wrap application data in headers and trailers, name protocol data units, transmit frames, and remove encapsulation at the destination.

Data encapsulation is the layer-by-layer addition of protocol control information to application data before transmission. At the receiving host, decapsulation is the reverse process: each layer examines and processes its relevant information, removes its wrapping, and passes the remaining payload upward.

This process allows different protocols to perform different jobs. An application needs information that explains the meaning and format of its exchange. Transport protocols identify communicating applications and can support delivery features. IP provides logical addressing between networks. The data-link layer prepares data for one local link, and the physical layer represents the resulting frame as signals.

Why Encapsulation Is Necessary

Application data by itself does not contain everything required to deliver it across a network. A web response, for example, needs to be associated with the correct application, placed inside an IP packet that can be routed, framed for the next local link, and converted into electrical, optical, or wireless signals.

Protocol information is usually added in a header, which contains control fields placed before a layer's payload. Some data-link technologies also add a trailer, which contains control fields placed after the payload. A payload is the data received from a higher layer and carried inside a lower-layer protocol unit.

The Five-Layer TCP/IP Teaching Model

A common teaching version of the TCP/IP model has five layers:

Application: Defines the format and meaning of communication for user applications.
Transport: Provides process-to-process delivery using TCP or UDP.
Network: Uses IP logical addresses and routing to move data between networks.
Data Link: Frames an IP packet for one local network link.
Physical: Transmits the frame's bits as signals over a medium.

Some TCP/IP diagrams combine the Data Link and Physical layers into one Link or Network Access layer. The names may differ, but the responsibilities remain distinguishable.

On a sending host, encapsulation moves down the stack. On a receiving host, decapsulation moves up the stack. A router normally works through the network layer for forwarding, while rebuilding the data-link wrapping for each connected link.

Encapsulation by TCP/IP Layer

Layer	Primary responsibility	Information added or handled	Resulting protocol data unit	Representative protocols or fields
Application	Defines application communication and its meaning	Application data and protocol format	Data	HTTP request, HTTP response, web content
Transport	Provides process-to-process delivery	Transport header, ports, and possibly reliability information	Segment when TCP is used	TCP or UDP; source and destination ports; TCP sequence and acknowledgment numbers
Network	Provides logical addressing and routing between networks	IP header	IP packet	Source and destination IP addresses
Data Link	Delivers the packet across one local link	Data-link header and commonly a data-link trailer	Frame	Ethernet fields, MAC addresses, frame-checking information
Physical	Transmits bits over the medium	Signals representing bits; it does not add an IP, TCP, or application header	Bits or signals	Electrical, optical, or wireless transmission

Application-Layer Data

The Application layer contains protocols that define the format and meaning of information exchanged by user applications. HTTP, the Hypertext Transfer Protocol, is a familiar example.

When a browser requests a web page, the HTTP request contains application-level information such as the requested resource. The server returns an HTTP response containing status information, headers, and requested web content. The HTTP information and the content being requested or returned belong to the application-level exchange. Lower layers carry this exchange but do not interpret the page's meaning.

Transport-Layer Encapsulation

TCP or UDP receives application data and adds a transport header. The header includes source and destination port numbers. Ports identify the sending and receiving applications or services on the endpoint hosts. An IP address identifies a host or network-layer endpoint; a port helps identify the application within that host.

TCP also includes fields that support reliable, ordered delivery. A sequence number tracks the position of data in the byte stream, and an acknowledgment number indicates data that has been received and is expected next. TCP may divide application data into multiple pieces.

When TCP is used, the transport-layer protocol data unit is normally called a segment. UDP transport data is often called a datagram. In either case, the transport result becomes the payload for IP.

Network-Layer Encapsulation

IP adds a network-layer header around the transport-layer unit. The header contains a source IP address and a destination IP address. These logical addresses identify the origin and intended destination at the network layer.

Routers use the destination IP address and their routing information to choose a path between networks. After IP encapsulation, the transport segment is carried as the payload of an IP packet. The IP packet is then passed to the data-link layer for delivery across the next local link.

Data-Link-Layer Encapsulation

The Data Link layer prepares an IP packet for one specific local link. For example, Ethernet adds a data-link header and a trailer around the IP packet. The complete result is a frame.

The exact structure depends on the local link protocol. A frame can contain link-layer addressing and error-detection information. The data-link header and trailer apply to that local transmission; they are not a permanent wrapper that necessarily remains unchanged across the entire path.

Physical Transmission

The Physical layer represents the frame as a sequence of bits and transmits those bits as signals. Depending on the medium, the signals may be electrical, optical, or wireless.

The Physical layer does not add an IP header, TCP header, or application header. It handles the representation and movement of bits. The logical headers and trailers were created by higher layers, although the physical layer carries the resulting frame.

Protocol Data Unit Terminology

A protocol data unit, or PDU, is the unit of data associated with a particular layer. The name changes as encapsulation adds each layer's information.

Name	Associated layer	Contains	Typical identifying fields
Data	Application	Application protocol information and user content	HTTP request, HTTP response, web content
Segment	Transport, especially TCP	Application data plus a TCP header	Source and destination ports, sequence and acknowledgment numbers
Packet	Network, specifically IP	Transport unit plus an IP header	Source and destination IP addresses
Frame	Data Link	IP packet plus a data-link header and commonly a trailer	Link-layer addresses and error-detection fields
Bits or signals	Physical	Physical representation of the frame	Electrical, optical, or wireless signal states

Textbooks and protocols sometimes vary slightly in their terminology. For example, some use data broadly or call a UDP unit a datagram. The important relationship is that a TCP segment is carried in an IP packet, and an IP packet is carried in a data-link frame.

Complete Web Example

A web server prepares an HTTP response containing protocol information and page content.
TCP adds transport fields, including source and destination ports and sequencing information. The result is a TCP segment.
IP adds source and destination IP addresses. The result is an IP packet.
Ethernet or another data-link protocol adds a local-link header and trailer. The result is a frame.
The Physical layer transmits the frame as bits and signals.
The client receives the signals and reconstructs the frame.
The client removes and processes the data-link information, processes the IP packet, removes and processes the TCP information, and delivers the HTTP content to the browser.

Application data
    + TCP header                         = TCP segment
    + IP header                          = IP packet
    + Data-link header and trailer       = Data-link frame
    + Physical representation            = Bits/signals

Decapsulation at the Destination

Decapsulation is not merely deleting headers. Each receiving layer examines the fields relevant to its job, validates or uses them as appropriate, removes its own wrapping, and passes the remaining payload to the next layer.

Sending host action	Layer	Receiving host action
Creates application data such as an HTTP request or response	Application	Receives the application data and gives it to the correct program
Adds TCP or UDP information	Transport	Uses ports to select the correct application; TCP processes sequencing and acknowledgments
Adds source and destination IP information	Network	Processes the IP packet and determines whether it is for the host or should be forwarded
Adds a local-link header and trailer	Data Link	Checks and removes the frame's link-layer information, exposing the IP packet
Represents the frame as transmitted signals	Physical	Receives signals and reconstructs the bit stream for the Data Link layer

End-to-End and Hop-by-Hop Behavior

Transport and IP information are associated with communication between endpoint hosts. Data-link framing, however, applies to one local link at a time.

Suppose a host sends an IP packet through a router:

The sending host places the IP packet inside a frame addressed to the appropriate local next hop.
The router receives the frame and removes the incoming data-link encapsulation.
The router examines the IP packet and uses the destination IP address to choose an outgoing interface.
The router places that IP packet into a new frame appropriate for the next network segment.

Therefore, MAC addresses and frame trailers can change at every hop. The incoming and outgoing frames are different local-link units. The IP packet continues toward its final destination, subject to normal network functions that may modify or reconstruct packets. Transport information is intended for the endpoint applications, not for each individual local link.

Encapsulation Compared with the OSI Model

The seven-layer OSI model is another reference model used to explain networking responsibilities. Its Application, Presentation, and Session layers are commonly related to the TCP/IP Application layer. OSI Transport, Network, Data Link, and Physical layers correspond closely to the similarly named TCP/IP teaching layers.

Encapsulation works as a conceptual model in either framework: a layer receives data from above, adds information needed for its responsibility, and passes the result below. Decapsulation reverses that direction at the destination.

Common Troubleshooting and Exam Traps

Calling every unit a packet

In casual conversation, people may call any transmitted data a packet. In layer-specific terminology, use segment for a TCP transport unit, packet for an IP network-layer unit, and frame for a data-link unit.

Assuming one frame crosses the entire routed path

A frame is local to a link. At every router, the incoming frame is removed and the IP packet is placed in a new outgoing frame.

Assuming every layer adds both a header and a trailer

Headers are broadly used for layer control information. A data-link protocol is the key common example of a layer adding both a header and a trailer. Do not automatically assign a trailer to every layer.

Confusing IP addresses with application identifiers

IP addresses identify network-layer endpoints and support routing. Source and destination ports identify applications or services within those endpoints.

Treating decapsulation as simple deletion

The receiver reads and uses each layer's control information before passing data upward. For example, transport processing uses port numbers to deliver data to the correct application, and TCP uses sequencing information to support ordered delivery.

Exam-Ready Summary

Encapsulation adds protocol control information as data moves down the sending stack.
Decapsulation processes and removes that information as data moves up the receiving stack.
Application data becomes a TCP segment, then an IP packet, then a data-link frame.
TCP uses ports and can use sequence and acknowledgment numbers for reliable, ordered delivery.
IP uses source and destination addresses for logical addressing and routing.
Data-link protocols frame packets for one local link and may add both a header and a trailer.
The Physical layer transmits bits as signals and does not add higher-layer headers.
Frames change at routers; data-link encapsulation is hop-by-hop.
IP and transport information describe endpoint communication, while link-layer information supports local delivery.

For a related reference, see Data Encapsulation.