Encapsulation, PDUs, and the TCP/IP Model
Unit 2: The OSI Model. Lesson 6 of 49 in NetPlus Academy.
Data does not travel as one blob. Each layer wraps the data from the layer above in its own header. That wrapping is encapsulation; unwrapping at the receiver is decapsulation.
Protocol data units, top to bottom
- Layers 7 to 5: data
- Layer 4: segment (TCP) or datagram (UDP), header adds source and destination ports
- Layer 3: packet, header adds source and destination IP addresses and a TTL (time to live) that drops by one at each router
- Layer 2: frame, header adds source and destination MAC addresses, trailer adds the frame check sequence
- Layer 1: bits
Sizes that matter
The MTU (maximum transmission unit) is the largest payload a frame can carry, 1500 bytes on standard Ethernet. Packets bigger than the MTU are fragmented or dropped. Jumbo frames raise the MTU to about 9000 bytes on links that support it, which helps storage and backup traffic.
The TCP/IP model
The four-layer TCP/IP model is what the protocols were actually built on: Application (OSI 5 to 7), Transport (OSI 4), Internet (OSI 3), and Network Access or Link (OSI 1 and 2). Questions may use either model, so be able to translate.
Encapsulation, PDUs, and the TCP/IP Model, explained slowly
The one picture to hold in your head
Data does not travel naked. Each layer wraps it in its own envelope, and the receiver opens the envelopes in reverse order. Wrapping is encapsulation. Unwrapping is decapsulation.
Sending (top down) Receiving (bottom up) [ data ] [ data ] [ TCP/UDP header | data ] segment open the port envelope [ IP header | segment ] packet open the address envelope [ Ethernet | packet | FCS ] frame open the MAC envelope 0101101001... bits
What each envelope adds
Layer Name of the unit What the header adds
7-5 data nothing you need to name
4 segment (TCP) source port, destination port
datagram (UDP)
3 packet source IP, destination IP, TTL
2 frame source MAC, destination MAC; trailer has the FCS
1 bits voltages, light, or radioThe TTL (time to live) is a counter in the IP header. Every router subtracts one. When it reaches zero the packet is thrown away. That stops a packet from circling forever if there is a routing loop, and traceroute uses it on purpose to find each hop.
Reading a packet capture
Wireshark shows the envelopes from the outside in, because that is the order they arrive:
- Ethernet header: source and destination MAC.
- IP header: source and destination IP, TTL.
- TCP or UDP header: source and destination port.
- The application payload, such as the HTTP request.
If a question asks which header holds a MAC address, IP address, or port, you now know which envelope to point at.
Sizes: MTU and jumbo frames
The MTU (maximum transmission unit) is the biggest payload one frame can carry. Standard Ethernet: 1500 bytes. A packet bigger than that must be chopped into pieces (fragmentation) or dropped. Jumbo frames raise the limit to about 9000 bytes so big transfers, such as backups and storage traffic, need fewer envelopes. Every device on the path must agree on the size. The classic symptom of a mismatch: small pings work, large transfers hang.
The TCP/IP model
The protocols were actually built on a four-layer model, and questions may use either. Translate:
TCP/IP model OSI layers Application 7, 6, 5 Transport 4 Internet 3 Network Access 2, 1 (also called Link)
How the exam asks it
- "At which layer is the data called a segment?" Layer 4.
- "Which field prevents a packet from looping forever?" TTL.
- "Ping works but file copies stall": MTU mismatch.
- "In the TCP/IP model, which layer maps to OSI Layers 1 and 2?" Network Access.
What to memorize
- Data, segment, packet, frame, bits.
- Ports at 4, IPs and TTL at 3, MACs at 2.
- MTU 1500, jumbo about 9000.