Encapsulation and one complete path

Suppose a browser sends an HTTP request. The request itself is just bytes of application data. Before those bytes reach the wire, each layer wraps them with its own header. TCP adds transport information. IP adds source and destination addresses. The local link adds the information needed for the next local hop.

flowchart LR
  accTitle: Network encapsulation and decapsulation
  accDescr: The sender wraps HTTP data in a TCP segment, IP packet, and link frame. The receiver removes those layers in reverse order.
  subgraph Sender
    HTTP["HTTP data"] --> TCP["TCP segment"] --> IP["IP packet"] --> Frame["Link frame"]
  end
  Frame --> Wire["Network path"] --> Received["Link frame"]
  subgraph Receiver
    Received --> ReceivedIP["IP packet"] --> ReceivedTCP["TCP segment"] --> Server["HTTP data"]
  end

This wrapping is called encapsulation. Think of it as envelopes inside envelopes: the HTTP request sits inside a TCP segment, which sits inside an IP packet, which sits inside an Ethernet or Wi-Fi frame.

The receiving side processes the headers in the opposite direction. The link layer strips the frame, IP strips its header, TCP strips its header, and each layer passes its payload upward until the web server receives the exact HTTP request the browser wrote.

See the layers around real data

You can watch encapsulation on your own machine. Start a capture of local web traffic, then make a request:

sudo tcpdump -ni any -c 4 port 443

IP 192.168.1.20.54312 > 104.21.4.157.443: Flags [S], seq 1187624
IP 104.21.4.157.443 > 192.168.1.20.54312: Flags [S.], ack 1187625

Every line describes one packet, and every field belongs to a different layer. IP 192.168.1.20 > 104.21.4.157 is the Internet layer. The .54312 and .443 port numbers belong to TCP. Add -e to the command and tcpdump also prints the MAC addresses from the link frame around it all. Several protocols, one piece of data.

What changes along the path, and what doesn’t

Routers normally replace the link framing at every hop while forwarding the IP packet. The frame that leaves your laptop is addressed to your router. The router strips it, reads the IP destination, and builds a fresh frame for the next link.

The end-to-end transport conversation belongs to the endpoints; each link frame belongs only to one local hop. The TCP header your browser wrote arrives at the server untouched. The Ethernet frame around it was rebuilt a dozen times along the way.

This is why a packet capture can show several protocols around the same piece of application data, and why the same capture looks slightly different depending on which link you take it from.