Topic 0.3
Encapsulation: Headers All the Way Down
In one line
Each layer wraps the data from the layer above in its own header, like envelopes inside envelopes; routers and switches only open the envelopes for their own layer.
Think of it like this
A letter in an envelope, inside a courier bag, inside a shipping container. The ship's crew only reads the container label; the courier only reads the bag label; only the recipient opens the envelope.
Key ideas
- 01
Sending an HTTP request: the application produces the HTTP text. TCP adds a header (source and destination ports, sequence numbers) to make a SEGMENT. IP adds a header (source and destination IP, TTL) to make a PACKET. Ethernet adds a header (MAC addresses) and trailer to make a FRAME. The receiver strips them in reverse order.
- 02
Names by layer, used constantly in tools and docs: bits (L1), FRAMES (L2), PACKETS (L3), SEGMENTS (TCP) or DATAGRAMS (UDP) at L4, and messages or requests at L7.
- 03
A router opens the frame, reads the IP header to decide where to send the packet next, decrements the TTL, and puts it in a NEW frame for the next link. MAC addresses change at every hop; IP addresses normally don't (unless NAT is involved, Phase 4).
- 04
Overhead matters at scale: IP (20 bytes) + TCP (20+ bytes) + Ethernet (18 bytes) on every packet. Tunnels (VPNs, VXLAN overlays used by Kubernetes CNIs) add more headers, which reduces the space for data and is why MTU problems show up in overlay networks.
Code & diagrams
tcpdump prints the headers of every layer for one request made from your own machine.
sudo tcpdump -i any -nn -c 5 -e 'tcp port 80' &
curl -s http://example.com > /dev/null
# -e prints link-layer (MAC) info; you'll see MACs, IPs, ports, and TCP flags per lineExplain it without notes
As a packet travels across five routers, which addresses in its headers change and which stay the same (without NAT)?
Practice
A VXLAN overlay adds 50 bytes of headers. If the underlying network's MTU is 1,500, what MTU should the overlay interfaces use to avoid fragmentation?
Trade-offs
- ↔
Encapsulation enables tunnels, overlays, and VPNs (networks on top of networks) but each layer of wrapping costs bytes, CPU, and MTU headroom, and makes packet captures harder to read.
Done when you can
I can describe how an HTTP request becomes a frame on the wire.
I know the names segment, packet, and frame and their layers.
I understand why MAC addresses change per hop while IP addresses don't.