Encapsulation and Data Flow

Every packet that leaves your laptop is dressed up in layers like an onion, and every packet arriving at the other end is peeled back the same way. That dressing and undressing is the most-asked concept in any networking interview and a guaranteed GATE CSE question. This lesson rebuilds the encapsulation–decapsulation idea so you can answer header-trailer questions without second-guessing.

Definition: Encapsulation — the process by which each layer of the sending host adds its own control information (a header, and sometimes a trailer) to the data received from the layer above, before passing it down.

Definition: Decapsulation — the reverse process at the receiver, where each layer reads and strips off the header/trailer added by its peer layer on the sender, then passes the remaining payload upward.

Definition: Protocol Data Unit (PDU) — the data unit at a particular layer along with its header/trailer. Each layer has its own PDU name (Segment, Packet, Frame, Bits).

Why Layered Models Need Encapsulation

The TCP/IP and OSI models split the work of moving bytes across a network into specialised layers. The Application layer worries about meaning ("send this HTTP GET"), Transport about reliability, Network about routing, Data Link about the next hop, and Physical about voltages on wire or radio waves. But the network only carries bits, so somewhere those layered intentions have to be packaged into a single travelling object. Encapsulation is that packaging mechanism. Each layer says: "Whatever you gave me, I will wrap with my own instructions for my counterpart on the other side, and hand it to the layer below."

The key consequence: a layer's header is a private message to its peer layer on the other host, not a message to neighbouring layers. The Transport header is read by the receiver's Transport layer; the Network header is read by every router along the path; the Data Link header by the next-hop interface. This is what textbooks call horizontal logical communication between peers, even though the physical movement of bits is strictly vertical — down the sender's stack, across the wire, up the receiver's stack.

The Five Names a Single Message Wears

As data travels down the sender's stack, the unit grows and changes name with each layer:

• Application data (also called Message or PDU at the Application layer) — the raw payload, e.g., an HTTP request or a DNS query.
• Segment (TCP) or Datagram (UDP) — formed at the Transport layer when a TCP/UDP header is prepended. The TCP header carries source and destination ports, sequence and acknowledgment numbers, window size and flags (SYN, ACK, FIN).
• Packet (also called Datagram at this layer) — formed at the Network layer when an IP header is prepended. The IP header carries source and destination IP addresses, TTL, protocol number, fragmentation flags and checksum.
• Frame — formed at the Data Link layer when a frame header is prepended and a trailer is appended. The header carries source and destination MAC addresses; the trailer carries the FCS (Frame Check Sequence) / CRC used for error detection.
• Bits — at the Physical layer, the frame is finally serialised into a stream of 0s and 1s and pushed onto the medium.

Real-world example: When you open https://www.gate.iitb.ac.in from a Wi-Fi laptop, the GET request is wrapped in a TCP segment (port 443), then in an IP packet (your private IP to IIT-B's public IP), then in an Ethernet/Wi-Fi frame (your MAC to your router's MAC), and finally radiated as bits over 2.4 / 5 GHz. The router decapsulates only up to the Data Link/Network layer (it needs the IP header to forward), rewraps with a new frame for the next hop, and onward.

Why the Data Link Layer Adds a Trailer Too

This is the most-asked GATE trick. Almost every layer adds only a header. The Data Link layer is unique — it adds both a header and a trailer. The reason is the CRC / FCS used for error detection. The transmitter computes a checksum over the header + payload and appends it as the trailer; the receiver recomputes and compares. Because the CRC must cover the whole frame, including the Data Link header, it cannot be sitting in the header — it has to come after the data. That's why the trailer exists.

Common misconception: Many students think IP also has a trailer because it has a "checksum field". It does not. IPv4 has a header checksum inside the header, covering only the header, not the data. There is no IP trailer. Only the Data Link layer attaches a trailer (FCS).

Decapsulation — Peeling the Onion at the Receiver

At the receiver, the bits arrive at the Physical layer, are reassembled into a frame, and start their journey upward. Each layer:

1. Reads the header (and trailer, in case of Data Link) addressed to it.
2. Validates it (e.g., MAC address match, IP destination match, port match).
3. Strips it off.
4. Passes the remaining payload to the next higher layer.

So at the receiver: Bits → Frame → Packet → Segment → Data — the exact mirror image of encapsulation. Each layer's "peer" header has done its job and is discarded; what remains for the Application layer is the original message.

Why it matters: This explains why a router only "looks" up to Layer 3 — it cannot read the TCP header without violating the layering, and it doesn't need to. It also explains overhead: every layer adds bytes, so the bigger the protocol stack, the more bytes of every transmission are control information rather than user data.

Question: An Ethernet frame carries an IP packet that carries a TCP segment that carries a 1000-byte HTTP request. If TCP, IP and Ethernet headers/trailers add 20, 20 and 18 bytes respectively, what is the total frame size?

Solution:
Step 1: Application data = 1000 B.
Step 2: TCP segment = 1000 + 20 = 1020 B.
Step 3: IP packet = 1020 + 20 = 1040 B.
Step 4: Ethernet frame = 1040 + 18 = 1058 B (14-byte header + 4-byte FCS trailer).
Conclusion: Total frame size = 1058 bytes, of which 58 bytes are protocol overhead.

Memorize these for numericals: TCP header = 20 bytes minimum, 60 bytes maximum (with options). UDP header = 8 bytes (fixed). IPv4 header = 20 bytes minimum, 60 bytes maximum. IPv6 header = 40 bytes (fixed, no options in base header). Ethernet frame: header 14 bytes (6 dest MAC + 6 src MAC + 2 type) + 4 bytes CRC trailer = 18 bytes overhead; payload 46-1500 bytes (MTU). Total overhead for TCP/IP/Ethernet (minimum) = 20 + 20 + 18 = 58 bytes. Efficiency = payload / (payload + headers). These figures appear constantly in throughput and overhead numericals.

Q: An application sends 1000 bytes using TCP over IPv4 over Ethernet (minimum headers). What is the transmission efficiency at the Data Link layer (ignoring preamble)? Solution: Total bytes on wire = data + TCP header + IP header + Ethernet overhead = 1000 + 20 + 20 + 18 = 1058 bytes. Efficiency = useful data / total = 1000 / 1058 = 0.9452 = 94.52%. If using UDP instead of TCP: 1000 + 8 + 20 + 18 = 1046, efficiency = 1000/1046 = 95.6%. Note the Ethernet overhead of 18 bytes = 14-byte header + 4-byte FCS trailer. Always include the trailer for Data Link layer.

Cover the answer, recall, then check. 12 cards on encapsulation, headers and data flow for GATE CSE.

Q1. Define encapsulation in the layered model.
A1. Each layer wraps the PDU from the layer above with its own header (and, at Data Link, a trailer). The upper-layer PDU becomes the "payload" of the lower layer.

Q2. Trace the naming of the PDU top-to-bottom as data descends the stack.
A2. Message/data (App) → segment (Transport, +TCP/UDP hdr) → packet/datagram (Network, +IP hdr) → frame (Data Link, +hdr+trailer) → bits (Physical).

Q3. Minimum and maximum size of the TCP header.
A3. Min 20 bytes, max 60 bytes (Data Offset field is 4 bits × 4-byte words → up to 15×4 = 60).

Q4. Minimum and maximum size of the IPv4 header.
A4. Min 20 bytes, max 60 bytes (IHL field 4 bits × 4-byte words, 5–15 words = 20–60 bytes).

Q5. Size of the UDP header and the Ethernet header/trailer.
A5. UDP header = 8 bytes (fixed). Ethernet: 14-byte header (6 dst + 6 src + 2 type) + 4-byte CRC trailer.

Q6. What is MTU, and a common Ethernet value?
A6. Maximum Transmission Unit — largest IP payload a link can carry in one frame. Ethernet MTU = 1500 bytes (max payload of the frame).

Q7. How much application data fits in one standard Ethernet frame over TCP/IP (no options)?
A7. 1500 (MTU) − 20 (IP) − 20 (TCP) = 1460 bytes = TCP MSS. With UDP: 1500 − 20 − 8 = 1472 bytes.

Q8. What is decapsulation?
A8. The reverse at the receiver: each layer strips its own header/trailer, verifies/uses it, and passes the payload up to the next layer.

Q9. How does a layer know which upper-layer protocol to hand a payload to?
A9. Via a demultiplexing key in the header: Ethernet Type (0x0800=IPv4, 0x0806=ARP), IP Protocol (6=TCP,17=UDP), TCP/UDP destination port.

Q10. Distinguish horizontal vs vertical communication.
A10. Horizontal (logical/peer): layer N at sender "talks to" layer N at receiver. Vertical (physical): actual data passes down then up through adjacent layers.

Q11. Which header fields change hop-by-hop vs stay end-to-end?
A11. MAC src/dst change at every router hop (new frame each link). IP src/dst normally stay constant end-to-end (except NAT). TTL decrements each hop.

Q12. If a 20-byte TCP header, 20-byte IP header and 18-byte Ethernet overhead wrap 1460 B data, what is total transmitted?
A12. 1460 + 20 + 20 + 18 = 1518 bytes = maximum standard Ethernet frame size (excluding 8-byte preamble/SFD).

Encapsulation is the mechanism that makes a layered protocol stack work: as user data moves down from the Application layer to the Physical medium, every layer prepends its own control information (a header, plus a trailer at the Data Link layer). The upper layer's entire PDU becomes the lower layer's payload. At the receiver the mirror process — decapsulation — strips these headers layer by layer. GATE loves numeric questions here: header sizes, MTU/MSS arithmetic, and overhead percentages.

PDU naming as data descends

Each layer renames the data unit and adds fixed overhead:

Layer	PDU name	Overhead added	Size
Application	Message / data	—	—
Transport (TCP)	Segment	TCP header	20–60 B
Transport (UDP)	Datagram	UDP header	8 B (fixed)
Network	Packet / datagram	IPv4 header	20–60 B
Data Link	Frame	Header + trailer (CRC)	18 B (Ethernet)
Physical	Bits	Line coding	—

Multiplexing and demultiplexing

A single lower layer serves many upper-layer protocols. The receiver decides where to hand each payload using a demultiplexing key in the header: Ethernet Type (0x0800 = IPv4, 0x0806 = ARP), IP Protocol (6 = TCP, 17 = UDP, 1 = ICMP), and the TCP/UDP destination port. This is why the same NIC can simultaneously carry web, DNS and ping traffic.

The MTU / MSS arithmetic you must memorise

• Ethernet MTU = 1500 bytes (max IP payload per frame).
• TCP MSS = MTU − IP header − TCP header = 1500 − 20 − 20 = 1460 bytes.
• UDP max payload in one frame = 1500 − 20 − 8 = 1472 bytes.
• Max standard Ethernet frame = 1460 + 20 + 20 + 18 = 1518 bytes (excludes 8-byte preamble/SFD).

Exam Tricks & Tips

• 🎯 Header size trap: IPv4 header and TCP header are both 20–60 B (variable via IHL / Data Offset). UDP is a fixed 8 B. Don't assume 20 B when "options present" is stated.
• 🎯 MSS = MTU − 40 for standard TCP/IP with no options; commit 1460 (TCP) and 1472 (UDP) to memory.
• 🎯 MAC changes every hop, IP stays end-to-end. In a hop-by-hop question, rewrite the frame's src/dst MAC at each router but keep IP src/dst (unless NAT).
• 🎯 Overhead % questions: efficiency = payload ÷ (payload + all headers). Reuse the 18-byte Ethernet + 40-byte IP/TCP figure.
• 🎯 Type/Protocol/Port are the three demux keys — know 0x0800, 0x0806, protocol 6/17/1.
• 🎯 TTL decrements at each router, so the IP header checksum must be recomputed at every hop.
• ❌ Common mistake: counting the Data Link trailer as another header — it is a trailer (after payload) carrying the CRC, and only the Data Link layer adds one.

Expected exam pattern

1–2 marks: given MTU and header sizes, compute MSS, max payload, number of frames, or transmission efficiency. Conceptual MCQs on PDU names, demux keys, and which fields change per hop. Occasionally combined with fragmentation.

Quick recap

Down the stack: message → segment → packet → frame → bits, each layer adding a header (Data Link also a trailer). Memorise header sizes (TCP/IP 20–60 B, UDP 8 B, Ethernet 18 B), MTU 1500, MSS 1460/1472, and the three demultiplexing keys. MAC is rewritten per hop; IP and ports are end-to-end.