Gyaan

How Data Travels (Encapsulation & Frames)

beginner encapsulation frames packets segments mtu

When we send data over a network, it doesn’t go as one big chunk. Each layer wraps it in its own header as it goes down the stack. The receiver unwraps them in reverse on the way up.

This wrapping is called encapsulation. The unwrapping is decapsulation.

The Russian Doll Analogy

Imagine sending a gift in nested boxes:

  • The gift = our data (e.g. an HTTP request)
  • Each layer adds a box around it with addressing info on the outside
  • The receiver opens box by box until they reach the gift

Each “box” is a header (and sometimes a trailer) added by a layer.

What Each Layer Adds

Application — Data
Raw payload (e.g. "GET /index.html HTTP/1.1...")
Transport — Segment
+ TCP/UDP header (src port, dst port, seq #, flags)
Internet — Packet (Datagram)
+ IP header (src IP, dst IP, TTL, protocol)
Link — Frame
+ Ethernet header (src MAC, dst MAC) + trailer (CRC)
Physical — Bits
Voltages, light pulses, radio waves on the medium

The PDU Names (Memorize These)

PDU = Protocol Data Unit. The chunk of data at each layer has a different name:

Application  -> Data / Message
Transport    -> Segment (TCP) or Datagram (UDP)
Internet     -> Packet
Link         -> Frame
Physical     -> Bits

Common interview shortcut: Data → Segments → Packets → Frames → Bits.

A Concrete Example

We type https://example.com and hit enter. Here’s what happens to the GET request as it goes down:

1. App layer:        "GET / HTTP/1.1\r\nHost: example.com..."
2. Transport (TCP):  [ TCP hdr (src:51234, dst:443, seq, ack, flags) | GET... ]
3. Internet (IP):    [ IP hdr (src:192.168.1.5, dst:93.184.216.34, TTL=64) | TCP segment ]
4. Link (Ethernet):  [ Eth hdr (src MAC, dst MAC) | IP packet | CRC trailer ]
5. Physical:         010110100110... (electrical/optical signal)

On the receiving server, the layers unwrap in reverse — Ethernet header is stripped, then IP, then TCP, until the HTTP request reaches the web server process.

Headers Carry the “How”

Each header answers a different question:

  • Ethernet header: which device on this LAN should pick this up? (MAC address)
  • IP header: which machine on the internet is this going to? (IP address)
  • TCP/UDP header: which app on that machine? (port number)
  • HTTP body: what does the app actually want? (the request)

MTU (Maximum Transmission Unit)

A frame can only be so big. Most Ethernet networks use an MTU of 1500 bytes. If our packet is bigger, it gets fragmented into smaller pieces.

# Check MTU on Linux/macOS
ifconfig en0 | grep mtu
# en0: ... mtu 1500

# Or check path MTU to a host
ping -D -s 1472 example.com   # -D sets don't-fragment flag (Linux)

Why 1472 above? 1500 (MTU) - 20 (IP hdr) - 8 (ICMP hdr) = 1472 bytes of payload before fragmentation.

If a packet is too big and the don’t-fragment bit is set, the router drops it and sends back an ICMP “fragmentation needed” message. This is path MTU discovery.

Decapsulation on the Receiver

bits arrive on cable
  -> NIC assembles a frame
  -> Strip Ethernet header / trailer (verify MAC, CRC)
    -> Strip IP header (verify dst IP, decrement nothing — already arrived)
      -> Strip TCP header (check seq/ack, route to port)
        -> Hand HTTP request to the web server

Common Gotcha

People mix up fragmentation (IP layer, splitting a big packet) with segmentation (TCP layer, breaking a stream into segments). Different layers, different problems. TCP segmentation is normal and clean; IP fragmentation is generally avoided because it hurts performance and reliability.

References