Skip to content

Beginner · How networks work · topic 4 of 57 · 30 min

The TCP/IP model and encapsulation

Explanation

The TCP/IP model is the model the internet actually runs on. It has 4 layers (or 5, when the bottom layer is split into data link and physical), and it maps neatly onto OSI. As data goes down the layers, each layer adds its own header: this is encapsulation. The receiver removes the headers in reverse order: de-encapsulation.

Why another model?

The OSI model is a teaching and talking tool. The protocols that actually run the internet, TCP, UDP and IP, were designed around a simpler model, the TCP/IP model (also called the internet protocol suite). Engineers use both: TCP/IP to describe real protocols and OSI layer numbers in everyday speech.

Four layers or five

The original TCP/IP model (described in RFC 1122) has 4 layers. Many books, including Cisco CCNA material, use a 5-layer version that splits the bottom layer into data link and physical, because those jobs are so different.

OSI layersTCP/IP 4-layerTCP/IP 5-layerExamples
7 Application, 6 Presentation, 5 SessionApplicationApplicationHTTP, HTTPS, DNS, DHCP, SSH, SMTP
4 TransportTransportTransportTCP, UDP
3 NetworkInternetNetworkIPv4, IPv6, ICMP
2 Data linkLink (network access)Data linkEthernet, Wi-Fi, ARP
1 PhysicalLink (network access)PhysicalCables, fibre, radio

Encapsulation: going down the stack

Encapsulation means wrapping. Each layer takes what the layer above gives it and adds its own header (control information) in front. Ethernet also adds a trailer at the end. Here is what happens when your browser asks a server for a web page:

  1. Application: the browser creates an HTTP request, for example GET /index.html. This is the data.
  2. Transport: TCP adds a header with the source port (a random high number such as 51514) and destination port 443 or 80. Now it is a segment.
  3. Network: IP adds a header with the source IP address (your PC) and destination IP address (the server). Now it is a packet.
  4. Data link: Ethernet adds a header with source and destination MAC addresses and a trailer with the FCS checksum. Now it is a frame.
  5. Physical: the NIC turns the frame into bits: electrical signals, light or radio waves.
output
Data:     [ HTTP request ]
Segment:  [ TCP header | HTTP request ]
Packet:   [ IP header | TCP header | HTTP request ]
Frame:    [ Eth header | IP header | TCP header | HTTP request | FCS ]
Bits:     0101100101110...
Each layer wraps the one above. The outermost header belongs to the lowest layer.
Think of it like this: It is like packing a gift for Diwali. You put the sweets in a box (data), the box in a gift bag with a name tag (segment), the bag in a courier envelope with a full address (packet), and the courier puts it in a sack labelled for the next depot (frame). At the other end, each wrapping is opened in reverse.

De-encapsulation: going up the stack

At the receiver, the NIC turns bits back into a frame. The data link layer checks the FCS and the destination MAC address, removes the Ethernet header and passes the packet up. The network layer checks the destination IP, removes the IP header and passes the segment up. The transport layer reads the destination port to find the right program (the web server), removes the TCP header, and hands the data to the application.

Routers in the middle only de-encapsulate up to Layer 3. They remove the old frame, read the IP header to choose the path, and build a brand new frame for the next link. The IP addresses stay the same end to end, while the MAC addresses change at every hop (router).

Same-layer and adjacent-layer interaction

  • Same-layer interaction: a layer on one machine talks to the same layer on the other machine through its header. The TCP header written by your PC is read only by the TCP layer on the server.
  • Adjacent-layer interaction: on one machine, a layer gives a service to the layer above it. TCP gives reliable delivery to HTTP; IP gives routing to TCP.
Careful: Common mistakes: saying MAC addresses stay the same across the internet (they change at every router; IP addresses do not, except where NAT changes them), forgetting the Ethernet trailer (FCS), and putting ARP or ICMP in the wrong place. ICMP is carried inside IP and is treated as a network layer protocol. ARP serves Layer 3 but is carried directly in Ethernet frames; most books place it at Layer 2 or between 2 and 3.
Tip: When an exam question says "TCP/IP model", check whether it means 4 layers (Link, Internet, Transport, Application) or 5. The word "Internet layer" tells you it is the 4-layer version.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

The TCP/IP model and encapsulation · 1/7

TCP/IP model

The internet runs on the TCP slash IP model. It has four layers, or five when you split the bottom layer into data link and physical.

Prefer a video by a teacher? Find free videos on “TCP/IP model encapsulation de-encapsulation explained CCNA” on YouTube ↗

In real life: Opening a Flipkart product page

When you tap a product, the app builds an HTTPS request (application). TCP wraps it with destination port 443 (transport). IP adds Flipkart's server address (network). Your phone wraps the packet in a Wi-Fi frame addressed to your home router (data link) and sends radio waves (physical). Your router removes the Wi-Fi frame, chooses the path and builds a new frame for the fibre link to the ISP. This repeats at every router until the server unwraps it all and reads your request. The reply is wrapped the same way in the opposite direction.

Practice (0/3 done)

Task 1 · Code · Python

Write layer_of(protocol) that returns the TCP/IP 5-layer name for a protocol. Use: "Application" for HTTP, HTTPS, DNS, DHCP, SSH, FTP, SMTP; "Transport" for TCP and UDP; "Network" for IP, IPv4, IPv6, ICMP; "Data link" for Ethernet, ARP, 802.11. Ignore upper or lower case. Unknown names return "Unknown".

Task 2 · Code · Python

Write encapsulate(data, headers) where headers is a list in the order the layers add them, for example ["TCP", "IP", "ETH"]. Each layer wraps what it got from the layer above, so the result for encapsulate("GET /", ["TCP", "IP", "ETH"]) is "ETH|IP|TCP|GET /". Then write decapsulate(frame) that removes the outermost header and returns the rest: decapsulate("ETH|IP|TCP|GET /") returns "IP|TCP|GET /".

Task 3 · Question

A packet crosses three routers from a PC in Kochi to a server in Bengaluru. What happens to the addresses?

Quick quiz

Question 1

1.Which layer of the 4-layer TCP/IP model matches OSI Layer 3?

Question 2

2.Which OSI layers are combined into the TCP/IP application layer?

Question 3

3.What does a segment become after the network layer adds its header?

Question 4

4.Which part is added at the end (a trailer) rather than at the front?

Question 5

5.The TCP header on a PC is read only by the TCP layer on the server. What is this called?

Read more (free)

Before this, learn

This topic builds on these. If something here feels new, open them first.

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

Which layer of the 4-layer TCP/IP model matches OSI Layer 3?

Answer: Internet

The Internet layer, where IP lives, matches the OSI network layer.

Which OSI layers are combined into the TCP/IP application layer?

Answer: Layers 5, 6 and 7

Session, presentation and application become one application layer.

What does a segment become after the network layer adds its header?

Answer: A packet

Segment plus IP header is a packet.

Which part is added at the end (a trailer) rather than at the front?

Answer: The Ethernet FCS

Ethernet adds the Frame Check Sequence as a trailer to detect errors.

The TCP header on a PC is read only by the TCP layer on the server. What is this called?

Answer: Same-layer interaction

Peer layers on two devices communicate through their headers: same-layer interaction.

How many layers does the OSI model have?Related

Answer: 7

OSI has 7 layers; the practical TCP/IP model has 4.

From TCP/IP and the network layers

In the OSI model, which layer handles encryption and data formats such as JPEG?Related

Answer: Presentation

Layer 6, presentation, deals with formats, encryption and compression.

From The OSI model

What does a TCP receiver use the window size for?Related

Answer: To tell the sender how much data it can send before waiting for an ACK

Windowing is TCP flow control.

From TCP, UDP and port numbers

What does no switchport do on a layer 3 switch port?Related

Answer: Makes it a routed port that can take an IP address

no switchport turns the port into a layer 3 routed port, like a router interface.

From Inter-VLAN routing

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: TCP, UDP and port numbers →

Next steps

  1. 1 more topic in “How networks work” before its exam: TCP, UDP and port numbers.
  2. Module 1 exam: How networks work · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, Ethernet, MAC addresses and the Cisco CLI. 57 topics left in the course before the final exam.

← Previous: The OSI model