Encapsulation: The Russian Dolls

Wrapping the Gift

Encapsulation is the mechanism that makes the layered model work in practice. Each layer adds its own header (and sometimes trailer) to the data it receives from the layer above, wrapping it like a Russian nesting doll. The receiving end unwraps each layer in reverse.

Sending — Encapsulation (top to bottom):

1. Layer 7 (Application): You type "Hello" into a chat app. The app formats it as an HTTP POST request body.
2. Layer 4 (Transport): The OS wraps the HTTP data in a TCP segment, adding a TCP header containing: source port (e.g., 54321), destination port (80), sequence number, acknowledgment number, and flags.
3. Layer 3 (Network): The OS wraps the TCP segment in an IP packet, adding an IP header containing: source IP (192.168.1.100), destination IP (93.184.216.34), TTL, and protocol (TCP=6).
4. Layer 2 (Data Link): The network card wraps the IP packet in an Ethernet frame, adding an Ethernet header with source MAC and destination MAC (the next-hop router's MAC), plus a Frame Check Sequence (FCS) trailer for error detection.
5. Layer 1 (Physical): The NIC converts the entire frame into electrical pulses, light, or radio waves and transmits them.

Receiving — Decapsulation (bottom to top):

The receiving NIC captures the physical signal, reconstructs the bits, verifies the Ethernet FCS, strips the Ethernet header, passes the IP packet to the OS network stack, which strips the IP header, passes the TCP segment to the TCP stack, which strips the TCP header and reassembles segments in order, and finally delivers "Hello" to the chat application.

Why this matters for troubleshooting:

Each header contains diagnostic information. A packet capture tool like tcpdump or Wireshark reads these headers directly: a single captured line for one exchange shows the Layer 3 source and destination IPs, the Layer 4 protocol and ports, and the payload size — all sitting right there in the encapsulated headers, in the order they were wrapped.

The MTU constraint: Every Layer 2 medium has a Maximum Transmission Unit (MTU) — the largest frame it can carry. Standard Ethernet MTU is 1500 bytes. If an IP packet is larger than the MTU, it must be fragmented — split into multiple smaller packets at Layer 3. Fragmentation adds overhead and can cause subtle performance problems. Modern networks use Path MTU Discovery (PMTUD) to find the smallest MTU along a path and avoid fragmentation. Misconfigured firewalls that block ICMP "Fragmentation Needed" messages break PMTUD and cause mysterious connection hangs — a classic senior-level debugging scenario.