Overview
Encapsulation works in the TCP/IP model just as it does in OSI: each layer wraps the data from the layer above with its own header. This lesson revisits encapsulation specifically in TCP/IP terms and traces a full round trip, reinforcing how real internet traffic is built and unpacked.
Learning objectives
- Describe encapsulation across the four TCP/IP layers.
- Trace data down the sender's stack and up the receiver's.
- Connect encapsulation to what security tools inspect.
Core concept
In TCP/IP, encapsulation adds a header at each layer going down the stack:
- Application produces the data (e.g. an HTTP request).
- Transport (TCP/UDP) adds a header with source/destination ports → segment/datagram.
- Internet (IP) adds a header with source/destination IP addresses → packet.
- Link (Ethernet) adds a header/trailer with MAC addresses → frame, then sends it as signals.
The receiver decapsulates in reverse, each layer stripping its own header and passing the rest up.
How it works
Each header carries exactly what the matching layer on the other end needs: ports for the transport layer to reach the right service, IPs for routing, MACs for local delivery. Routers along the way primarily read and rewrite the link-layer frame at each hop while leaving the IP packet's addresses intact — which is why the destination IP is constant end to end but the MAC changes hop by hop (as you saw in the OSI addressing lesson).
Practical example
Sending an HTTPS request: your device wraps it in a TCP header (port 443), then an IP header (server's address), then an Ethernet frame (next hop's MAC), and transmits it. Each router decapsulates to the IP layer, decides the next hop, rewraps in a new frame, and forwards. The server finally strips every header in turn and hands the original request to its web application. The same data, wrapped and unwrapped layer by layer across the whole internet.
Cybersecurity relevance
Where a security tool operates decides what it can see. A basic packet filter reads IP (internet) and port (transport) headers; deep packet inspection and web application firewalls parse the application-layer payload. Understanding encapsulation tells you which fields a given control or attack can access — foundational for both firewall design and traffic analysis.
Common mistakes
- Believing routers rewrite IP addresses on every hop — they normally preserve the destination IP and change only the link-layer frame (NAT is a special exception, covered later).
- Forgetting that encryption (HTTPS/TLS) hides the application payload from tools that only see lower layers.
Key takeaways
- TCP/IP encapsulation adds transport (ports), internet (IP), and link (MAC) headers as data goes down the stack.
- Decapsulation reverses this on the receiver; destination IP stays constant while MAC changes each hop.
- The layer a security tool inspects determines which headers or payloads it can read.
Check your understanding
- What header information does each of the Transport, Internet, and Link layers add?
- Why can a simple port/IP firewall not read the contents of an HTTPS request?