Overview
As data moves down the layers of the network stack, each layer wraps it with its own control information. This wrapping process is called encapsulation, and its reverse — unwrapping on the receiving side — is decapsulation. It is how the layered model actually carries data.
Learning objectives
- Define encapsulation and decapsulation.
- Describe how headers are added and removed per layer.
- Recognize the changing name of data at each layer.
Core concept
Encapsulation means each layer adds its own header (and sometimes a trailer) around the data it receives from the layer above, treating that data as its payload. The unit of data therefore gets a different name at each layer — this is a Protocol Data Unit (PDU):
- Transport layer → segment (TCP) or datagram (UDP)
- Network layer → packet
- Data Link layer → frame
- Physical layer → bits
How it works
Sending data, each layer wraps the previous layer's output:
- The application data is handed down.
- Transport adds a header with ports → segment.
- Network adds a header with IP addresses → packet.
- Data Link adds a header/trailer with MAC addresses → frame.
- Physical transmits it as bits.
On the receiving host, the process reverses (decapsulation): each layer reads and removes its header, then passes the remaining payload up. Each layer only reads the header meant for it, ignoring the rest.
Practical example
Loading a web page, your browser's request (Layer 7) is wrapped by TCP with port 443 (segment), then by IP with the server's address (packet), then by Ethernet with the next hop's MAC (frame), then sent as bits. The web server reverses it: strips the Ethernet frame, then the IP header, then the TCP header, finally handing the original request up to its web server software. Each layer added exactly what the matching layer on the other side needed.
Cybersecurity relevance
Understanding encapsulation is essential for reading packet captures and for grasping how firewalls and analysis tools work: a firewall inspecting Layer 3/4 reads IP and port headers, while deep inspection reaches into the Layer 7 payload. Attacks and defenses often hinge on which headers a device examines.
Common mistakes
- Thinking a lower layer reads the whole packet's contents — each layer normally reads only its own header.
- Confusing the PDU names — segment (L4), packet (L3), frame (L2) refer to the same data at different layers.
Key takeaways
- Encapsulation adds a per-layer header (and sometimes trailer) as data moves down the stack; decapsulation removes them on the way up.
- The data unit is named segment/datagram (L4), packet (L3), frame (L2), and bits (L1).
- Each layer reads only its own header, which underlies how firewalls and analyzers inspect traffic.
Check your understanding
- What is the data unit called at the Transport, Network, and Data Link layers?
- Explain what happens during decapsulation on the receiving host.