3. Encapsulation: the nested-envelope model

3.1 The core mechanic

As your data goes down the stack on the sender, each layer wraps it in a header (and sometimes a trailer). This is encapsulation. On the receiver, each layer strips its header and hands the rest up — decapsulation. The payload of one layer is the entire packet of the layer above.

Application data:                          [ HTTP request bytes ]
                                                   |
TCP adds header (ports, seq, flags):    [ TCP hdr | HTTP request bytes ]   = "segment"
                                                   |
IP adds header (src/dst IP, TTL):  [ IP hdr | TCP hdr | HTTP request ]     = "packet"
                                                   |
Ethernet adds header + trailer:
[ Eth hdr | IP hdr | TCP hdr | HTTP request | Eth FCS ]                    = "frame"
                                                   |
                                            serialized as bits on the wire

Physical analogy: you write a letter (data), seal it in an envelope addressed to a person (TCP port = which person in the building), put that envelope inside a courier pouch addressed to a building (IP address), and hand the pouch to a driver who only knows the next depot (MAC address / next hop). Each handler reads only their own label.

3.2 Header sizes to memorize

Overhead example. On classic Ethernet (MTU 1500), a full TCP/IPv4 segment carries 1500 − 20 (IP) − 20 (TCP) = 1460 bytes of application data — the MSS (Maximum Segment Size). With TCP timestamps enabled (the common case), options eat 12 more bytes, so MSS is often 1448. Sending 1 GB of data therefore costs roughly 1e9/1448 × (14+20+32+4) ≈ 48 MB of pure header/framing overhead (~4.8%).

3.3 The same bytes, four names

The industry uses different nouns for "the thing at this layer," and mixing them up causes confused conversations:

• Frame — link layer (has MAC addresses).
• Packet — network layer (has IP addresses). Also the generic word.
• Datagram — a self-contained packet with no connection state. Used for both IP packets and UDP messages.
• Segment — a TCP unit (part of the byte stream).
• Message — application layer.

3.4 Demultiplexing keys

How does the receiver know which upper protocol to hand the payload to?

• Ethernet header's EtherType field: 0x0800 = IPv4, 0x86DD = IPv6, 0x0806 = ARP.
• IP header's Protocol field (v4) / Next Header (v6): 6 = TCP, 17 = UDP, 1 = ICMP, 58 = ICMPv6.
• TCP/UDP destination port: 443 → your HTTPS server process, 53 → DNS.

So a browser packet is delivered by the chain: NIC → (EtherType 0x0800) → IP stack → (Protocol 6) → TCP → (dst port matches a listening socket's 4-tuple) → your process's file descriptor.

3.5 War story

A team saw mysterious 4-byte-larger frames and MTU errors after a data-center migration. Cause: the new top-of-rack switches added an 802.1Q VLAN tag (4 bytes) to every frame, pushing some full-size packets to 1518 bytes on links where an intermediate device enforced a strict 1514 limit. Fix: lower the host MTU to 1496 or enable jumbo/baby-jumbo frames end to end. Lesson: encapsulation overhead is not fixed; every tag, tunnel, and VPN steals bytes from your payload budget (see Chapter 8 and 56).

Try it yourself

# Show encapsulation layers explicitly
sudo tcpdump -i any -c1 -e -n 'tcp port 443' -vv
# Read from outside in: MAC.. > MAC.., ethertype IPv4, IP.. > IP.., Flags [S], ...