Layers and encapsulation
Networks split a hard problem into layers, and every layer wraps your data in its own header. See a real web request get wrapped, sent as bits, forwarded and unwrapped.
In this lecture you will
- Explain why networking is organized into layers
- Map the TCP/IP model to the seven-layer OSI model
- Describe what the transport, network and link layers each add to a message
- Relate devices and job titles (switch, router, “layer 7 load balancer”) to the layers they work on
In the last lecture a single page load involved DNS, routers, TCP, TLS and HTTP. How do so many protocols — designed by different people over decades — work together without chaos? The answer is layering, one of the most important design ideas in computing.
One problem per layer
Getting data from one application to another across the world involves several separate problems:
- turning signals on a wire, fiber or radio into bits, and back;
- moving data from one device to the next on the same link;
- getting data across many networks to the right machine;
- delivering it to the right program, reliably and in order;
- making the data mean something to that program — a web page, an email, a video.
Networking gives each problem its own layer. A layer uses the services of the layer below and offers services to the layer above, without caring how the others work. Your browser doesn’t know whether you’re on Wi-Fi or fiber; Wi-Fi doesn’t know it’s carrying a web page.
Two models of the same idea
You will meet two layer models. The OSI model has seven layers and is mostly used as a shared vocabulary. The TCP/IP model has four and matches how the internet is actually built.
| OSI layer | TCP/IP layer | What it does | Examples |
|---|---|---|---|
| 7 Application, 6 Presentation, 5 Session | Application | Meaning for programs | HTTP, DNS, TLS, SMTP |
| 4 Transport | Transport | Deliver to the right program, reliably or quickly | TCP, UDP, QUIC |
| 3 Network | Internet | Deliver across networks to the right machine | IP (v4 and v6), ICMP |
| 2 Data link, 1 Physical | Link | Deliver across one link; signals and bits | Ethernet, Wi-Fi, fiber |
When engineers say “that’s a layer 2 problem” or “we need a layer 7 load balancer”, they are using OSI numbers — so it pays to remember them.
Layering has a neat consequence: each layer behaves as if it were talking directly to the same layer on the other machine, even though only the bottom layer ever touches a cable.
- Two stacksYour laptop and the web server run the same four layers, from the application at the top to the link at the bottom.
- HTTP to HTTPThe browser and the web server exchange HTTP messages as if nothing else existed: a request goes out, a response comes back.
- Every layer has a partnerTCP talks to TCP about ports, sequence numbers and acknowledgements; IP talks to IP about addresses; Ethernet talks to Ethernet about one link. Each reads only its own header.
- The real pathPhysically, the bytes travel down the laptop’s stack, across the link and up the server’s stack. The peer conversations are carried inside each other.
- Independent layersBecause each layer only depends on the interface of the one below, you can replace one — Wi-Fi with fiber, IPv4 with IPv6 — without changing the others.
Watch a request get wrapped
The browser hands a small HTTP request down the stack. Each layer adds a header in front — and the link layer also adds a trailer — before the whole thing leaves as bits. Step through it, then watch what happens at a router and at the destination.
- Application dataThe browser produces an HTTP request: GET /index.html with a Host header. To the layers below, this is just a block of bytes to deliver.
- Transport: add a TCP headerTCP adds source and destination ports (51234 → 443) plus sequence and acknowledgement numbers for reliable delivery. Header plus data is called a segment.
- Network: add an IP headerIP adds the source and destination IP addresses and a Time To Live (TTL) counter. The unit is now a packet, and routers will read only this header.
- Link: build a frameEthernet or Wi-Fi adds a header with MAC addresses for this single link — the destination is your router, not the server — and a checksum trailer (FCS) to detect corruption.
- Physical: bits on the wireThe frame is sent as a stream of bits: voltages on copper, pulses of light in fiber, or radio waves for Wi-Fi.
- At a router: only the outside changesThe router checks the frame, removes it, reads the IP header, lowers the TTL by one and wraps the packet in a new frame for the next link. The IP addresses inside do not change.
- At the destination: unwrapThe server removes each header in reverse order — frame, IP, TCP — and hands the original HTTP bytes to the web server program listening on port 443.
What each header carries
A few fields do most of the work. You’ll see them constantly in logs, firewall rules and packet captures.
- Port numbers (transport)
- Identify the application: 443 for HTTPS, 53 for DNS, 22 for SSH. The client picks a temporary high-numbered port for its side of the conversation.
- IP addresses (network)
- Identify the source and destination machines end to end. Routers make every forwarding decision from the destination address.
- TTL (network)
- Time To Live: a counter every router lowers by one. At zero the packet is discarded, so a routing loop cannot trap packets forever.
- MAC addresses (link)
- Hardware addresses of network interfaces, meaningful only on the local link — for example, your laptop and your Wi-Fi router.
- FCS (link)
- Frame Check Sequence: a checksum that lets the receiver detect bits damaged in transit and drop the frame.
Size limits: MTU and MSS
Every link has a maximum transmission unit (MTU) — the largest packet it will carry in one frame. For Ethernet it is 1,500 bytes. Since the IP header takes at least 20 bytes and the TCP header another 20, a single segment can carry at most 1,460 bytes of data, known as the maximum segment size (MSS).
Large responses are therefore split into many segments, and TCP puts them back together in order at the other end. When a link along the path has a smaller MTU — common with VPNs and tunnels, which add their own headers — oversized packets can be dropped, leading to connections that open fine but hang when real data flows.
Build a frame yourself and see how the headers add up.
Push the payload to 1,460 bytes with TCP over IPv4: it just fits. Now add the VPN tunnel — the same payload no longer fits the 1,500-byte MTU, which is exactly why VPN users see mysterious hangs.
Devices and the layers they read
Knowing which layer a device works at tells you what it can and cannot see:
- A switch forwards frames within a local network using MAC addresses (layer 2).
- A router forwards packets between networks using IP addresses (layer 3).
- A layer 4 load balancer or firewall decides using IP addresses and ports.
- A layer 7 load balancer, API gateway or web application firewall reads the HTTP request itself — paths, headers, cookies.
Next, we take a closer look at the network layer’s most important field: the IP address, and how networks are carved into subnets.
Key takeaways
- Each layer solves one problem and relies on the layer below; none needs to understand the others.
- Sending wraps data in headers (encapsulation); receiving removes them in reverse (decapsulation).
- Transport headers carry ports, network headers carry IP addresses and a TTL, link headers carry MAC addresses.
- Routers rewrite the outer link-layer header at every hop but leave the IP addresses alone.
Check your understanding
4 questions · answers explainedQ1Which header carries the port number that identifies the application, such as 443 for HTTPS?
Q2A packet crosses five routers on its way to a server. What happens to its link-layer (Ethernet) header?
Q3Why does a TCP segment usually carry at most 1,460 bytes of data on an Ethernet network?
Q4A load balancer that routes requests based on the URL path (for example /api versus /images) works at which layer?