Chapter 2 — Layers: the postal-service idea · TCP/IP

In one sentence

Networking is organised in layers, where each layer does one job and treats everything above it as "cargo it doesn't need to understand".

The problem

You could design a network as one giant program that handles everything: wires, addressing, retransmission, encryption, web pages. People tried. It's unmaintainable, and every new technology (Wi-Fi, fibre, 5G) would require rewriting everything.

The idea, in plain language

Split the work into stacked layers. Rules:

Each layer only talks to the layer directly above and below it.
Each layer treats the layer above's data as opaque cargo.
Each layer can be swapped out without touching the others.

That third rule is the payoff: Wi-Fi replaced Ethernet cables without changing a single web browser. HTTP/3 was invented without upgrading a single router.

How it actually works: wrapping

As your data goes down the layers, each layer wraps it in a header — a small block of its own information, stuck on the front.

Your data:                                   [ "Hello" ]

Transport layer adds its header:      [ TCP hdr | "Hello" ]
   (says: which program on each end, and this is chunk #5)

Internet layer adds its header:  [ IP hdr | TCP hdr | "Hello" ]
   (says: from this machine, to that machine)

Link layer adds its header:  [ Eth hdr | IP hdr | TCP hdr | "Hello" ]
   (says: from this network card, to that network card, on this cable)

                             ---> onto the wire as electricity/light/radio

At the other end, the same thing happens in reverse — each layer peels off its own header and hands the rest up. This is called encapsulation (going down) and decapsulation (coming up).

The postal analogy again, precisely:

   NETWORKING                          POST
   ----------                          ----
   your data           <--->   the letter you wrote
   TCP header          <--->   "To: Sarah, Accounts Dept"  (which person)
   IP header           <--->   "To: 12 High St, Berlin"    (which building)
   Ethernet header     <--->   "Next stop: Frankfurt depot" (next hop only)

The key insight: the Ethernet header is rewritten at every hop (each depot writes a new "next stop"), while the IP header stays the same the whole journey (the building address never changes). You'll see this again in Chapter 13.

Worked example: see a real packet's layers

Run this (it captures one packet and shows all its layers):

sudo tcpdump -i any -c 1 -e -n 'tcp port 443'

Then, in another terminal (or just browse the web), trigger some traffic:

curl -s https://example.com > /dev/null

You'll see something like:

14:22:01.123456 aa:bb:cc:dd:ee:ff > 11:22:33:44:55:66, ethertype IPv4 (0x0800),
    length 74: 192.168.1.50.51000 > 93.184.216.34.443: Flags [S], seq 1234567,
    win 64240, length 0
    \_______________________/  \_________________________________/
       LINK LAYER (Ethernet)      INTERNET LAYER (IP)  +  TRANSPORT (TCP)
       who's next door             who globally         which program

Read it left to right and you are reading the layers from outside in. You don't need to understand every field yet — just see that they're nested.

Common confusions

"Is this the OSI model?" The OSI model has 7 layers and is taught in certifications. TCP/IP has 4 and is what actually runs. Chapter 3 shows both and how they line up.
"Do all 4 layers exist in every packet?" Essentially yes for normal traffic. Some packets (like ARP, Chapter 6) skip the IP layer.
"Why is there overhead?" Each header is real bytes on the wire. A typical packet spends ~54 bytes on headers to carry up to 1460 bytes of data — about 4% overhead. That's the price of the design, and it's a bargain.

Check yourself

What does "encapsulation" mean?
Which header gets rewritten at every hop, and which stays the same?
Why does layering mean HTTP/3 could be invented without upgrading routers?

Chapter 2 — Layers: the postal-service idea