Encapsulation and Decapsulation

What is Encapsulation?

Encapsulation is the process by which data is wrapped with protocol information at each layer of the OSI model as it travels from the Application layer down to the Physical layer on the sending device. Think of it like putting a letter in an envelope, then putting that envelope in a larger package, then putting that package in a shipping container. Each layer adds its own "envelope" (header) around the data from the layer above.

Each layer treats the entire content it receives from the layer above — including that layer's header — as its payload. It then adds its own header and passes the whole thing down to the next layer. By the time data reaches the Physical layer, it has been progressively wrapped inside multiple layers of protocol information.

Why Encapsulation Matters

Encapsulation enables the fundamental principle of network modularity — separation of concerns. Each layer can be designed, implemented, and modified independently:

• A TCP segment does not know or care whether it is carried over Ethernet or WiFi
• An IP packet does not know if it is inside a TCP segment or a UDP datagram from the application's perspective
• An Ethernet frame does not know whether its payload is an IP packet or an ARP request

This modularity means you can upgrade your physical network from copper to fiber without changing any application code. You can switch from IPv4 to IPv6 without redesigning your Ethernet infrastructure. Layers can evolve independently because each one only interacts with the layer directly above and below it.

Encapsulation at Each Layer (Step by Step)

Application Layer → Data

The user's data starts here. For example, the body of an email, a web page request, or a file being transferred. This is the raw content the user wants to send.

Transport Layer → Segment

The Transport layer divides the application data into manageable chunks (if needed) and adds a header. For TCP, this header includes:

• Source port (16 bits) — identifies the sending application
• Destination port (16 bits) — identifies the receiving application (e.g., port 80 for HTTP)
• Sequence number (32 bits) — position of this segment in the data stream
• Acknowledgment number (32 bits) — confirms receipt of data
• Flags — SYN, ACK, FIN, etc. for connection management

Network Layer → Packet

The Network layer wraps each segment in a packet by adding an IP header containing:

• Source IP address (32 bits) — who is sending
• Destination IP address (32 bits) — who should receive
• TTL (Time to Live) (8 bits) — prevents infinite routing loops
• Protocol field (8 bits) — tells receiver which transport protocol (6=TCP, 17=UDP)

Data Link Layer → Frame

The Data Link layer adds both a header AND a trailer:

• Header: Source MAC address (48 bits), Destination MAC address (48 bits), Type/Length field
• Trailer: Frame Check Sequence (FCS) — a CRC value for error detection

Critical distinction: MAC addresses identify the NEXT HOP only, not the final destination. As a frame travels through routers, the MAC addresses change at each hop, but the IP addresses remain the same throughout the journey.

Physical Layer → Bits

The Physical layer converts the entire frame into a stream of individual bits (1s and 0s) and transmits them as physical signals — electrical voltages on copper wire, light pulses on fiber optic cable, or radio waves in wireless transmission.

Complete Encapsulation Visualization

Each layer adds approximately:

• Transport header: 20 bytes (TCP) or 8 bytes (UDP)
• Network header: 20 bytes (IPv4) or 40 bytes (IPv6)
• Data Link header + trailer: 18 bytes (Ethernet)

So a 1000-byte application message becomes roughly 1058 bytes on the wire — about 6% overhead.

Decapsulation (The Reverse Process)

Decapsulation happens on the receiving device. As data arrives at the Physical layer and passes upward, each layer reads and removes its corresponding header:

Physical Layer

Individual bits are received from the transmission medium and assembled into a complete frame.

Data Link Layer

• Reads the destination MAC address — verifies it matches this device (or is broadcast)
• Recalculates the CRC and compares with the FCS — if mismatch, frame is dropped (corrupted)
• Reads the Type field to determine which Network layer protocol should handle the payload
• Strips the frame header and trailer, passes the remaining packet upward

Network Layer

• Reads the destination IP address — verifies it matches this device
• Reads the Protocol field to determine which Transport layer protocol should receive the payload
• Checks TTL — should never be 0 at the destination
• Strips the IP header, passes the segment upward

Transport Layer

• Reads the destination port — determines which application should receive the data
• TCP: checks sequence numbers, sends acknowledgments, reassembles out-of-order segments
• Strips the transport header, passes the application data upward

Application Layer

• The original data is delivered to the receiving application
• The email client shows the message, the browser renders the page, the file transfer saves the file

PDU (Protocol Data Unit) Names at Each Layer

Real-World Analogy

Think of encapsulation like sending a package internationally:

1. You write a letter (Application data)
2. Put it in an envelope with sender/recipient names (Transport — port addresses)
3. Put the envelope in a padded mailer with street addresses (Network — IP addresses)
4. The courier puts it in their delivery bag with tracking barcode (Data Link — MAC, FCS)
5. The bag goes on a truck/plane (Physical — actual transmission)

At each step, the previous contents become the "payload" of the new container. The recipient unwraps in reverse order.

Key Points for Exams and Interviews

1. Encapsulation adds headers going DOWN the stack; Decapsulation removes them going UP
2. IP addresses stay the same end-to-end; MAC addresses change at every router hop
3. Each layer only reads the header meant for it and passes the rest upward
4. The FCS/CRC at the Data Link layer provides error DETECTION, not error correction
5. TTL is decremented at each router to prevent packets from circling forever
6. Understanding PDU names (Data → Segment → Packet → Frame → Bits) is frequently tested