Explain encapsulation and name the PDU at each layer.
Show the answer
Say this first
Going down the stack, each layer wraps the data from the layer above with its own header (and for Ethernet a trailer). Application data becomes a TCP segment or UDP datagram, then an IP packet, then an Ethernet frame, then bits on the wire. The receiver decapsulates in reverse, and each layer uses a type field to know who to hand the payload to next.
Go deeper
A web request on Ethernet
| Layer | PDU | Header added | Typical size |
|---|---|---|---|
| 7 | Data | HTTP | variable |
| 4 | Segment | TCP header (ports, seq, ack, flags) | 20 bytes, up to 60 with options |
| 3 | Packet | IPv4 header (addresses, TTL, protocol) | 20 bytes, up to 60 with options |
| 2 | Frame | Ethernet header 14 bytes + FCS 4 bytes | 18 bytes, 22 with an 802.1Q tag |
| 1 | Bits | Preamble and SFD 8 bytes, then 12 bytes of interframe gap | 20 bytes of wire overhead |
How the receiver knows what is inside
Each header has a field that names the next protocol. This is multiplexing on the way down and demultiplexing on the way up.
- Ethernet EtherType:
0x0800IPv4,0x86DDIPv6,0x0806ARP,0x8100802.1Q tag. - IPv4 Protocol (IPv6 Next Header): 1 ICMP, 6 TCP, 17 UDP, 47 GRE, 50 ESP, 89 OSPF.
- TCP or UDP destination port: 443 HTTPS, 53 DNS, 22 SSH.
Overhead in numbers
A full 1500-byte IP packet carrying TCP leaves 1460 bytes of application data (1500 minus 20 IP minus 20 TCP). On the wire it costs 1538 bytes: 1500 + 18 Ethernet + 20 preamble and gap.
They will ask next
Does a router decapsulate all the way to layer 7?
No. It strips the layer 2 frame, reads the layer 3 header, makes a forwarding decision, and builds a new frame for the outgoing link. It does not look at TCP or the payload unless a feature asks it to (ACLs matching ports, NAT, NetFlow, firewall inspection).
What is the minimum Ethernet frame size and why?
64 bytes from destination MAC to FCS. Shorter payloads are padded to 46 bytes. The minimum comes from half-duplex CSMA/CD: a sender must still be transmitting when a collision from the far end of a maximum-length segment reaches it, so it can detect the collision.
Traps
- Calling everything a "packet". Use frame for layer 2 and packet for layer 3 when precision matters.
- Forgetting the FCS is a trailer, not part of the header.