Encapsulation: data, segments, packets, frames and bits; MAC addresses vs IP addresses

Encapsulation is how each layer wraps the data it receives from the layer above with its own header (and sometimes a trailer) before handing it down. On the receiving side the process runs in reverse, called de-encapsulation: each layer reads and removes its own header and passes the rest up. This is why a packet capture shows nested sections, each belonging to one layer.

Each stage has a name, called a PDU (protocol data unit). At the application layers it is simply data. The Transport layer adds a TCP or UDP header with source and destination port numbers, and the result is a segment (with UDP, often called a datagram). The Network layer adds an IP header with source and destination IP addresses, making a packet. The Data Link layer adds a header with source and destination MAC addresses plus a trailer containing a Frame Check Sequence used to detect errors, making a frame. The Physical layer transmits the frame as bits: voltages on copper, pulses of light on fiber or radio waves in Wi-Fi. A memory aid is 'Do Some People Fear Birthdays': data, segment, packet, frame, bits.

The two kinds of address in that stack do different jobs. A MAC (Media Access Control) address is a 48-bit hardware address burned into a network interface, written as 12 hexadecimal digits such as 00:1A:2B:3C:4D:5E or 001a.2b3c.4d5e on Cisco devices. The first half usually identifies the manufacturer. MAC addresses only matter on the local network segment; switches use them to deliver frames to the right port. An IP address is a logical address assigned by configuration or DHCP, and it identifies both the network and the host, so routers can move packets across many networks to the final destination.

Here is the key behavior the exam likes: as a packet crosses routers, the source and destination IP addresses stay the same end to end (unless NAT changes them), but the MAC addresses are rewritten at every hop. Each router strips the incoming frame, looks at the IP header, and builds a new frame addressed from its own outgoing interface MAC to the next device's MAC. To learn the MAC address that belongs to a local IP address, IPv4 hosts use ARP (Address Resolution Protocol); IPv6 uses Neighbor Discovery.

You can see both addresses yourself. On Windows, ipconfig /all shows the Physical Address (MAC) and the IPv4 address; on Linux, ip addr shows link/ether and inet lines. arp -a lists the IP-to-MAC mappings your computer has learned.

Key terms

Encapsulation

Adding a layer's header (and trailer) to data as it moves down the stack before transmission.

PDU

Protocol data unit, the name for data at a given layer: data, segment, packet, frame or bits.

MAC address

A 48-bit hardware address used to deliver frames on the local network segment.

IP address

A logical address that identifies a host and its network, used by routers to forward packets between networks.

ARP

Address Resolution Protocol, which finds the MAC address that matches a known IPv4 address on the local network.

Check yourself