Ravindra BagaleCourses & study guides

3. OSI Model, TCP/IP Model, TCP vs UDP and the 3-Way Handshake

3.2 Encapsulation and Decapsulation

Mitrano, data khali jatana (sender side) pratyek layer swatahcha header laavto – jasa parcel var ek ek label chikatavla jato. Receiver side la ulta hota – pratyek layer aapla label kadhun data varchya layer la deto. Yala encapsulation (आवरण घालणे) aani decapsulation mhantat.

As data moves down, each layer adds its own header (Layer 2 also adds a trailer):

 L7-5   [                 HTTP data                   ]
 L4     [TCP hdr: ports ][        HTTP data           ]            = Segment
 L3     [IP hdr: IPs][TCP hdr][      HTTP data        ]            = Packet
 L2     [Eth hdr: MACs][IP][TCP][    HTTP data   ][FCS]            = Frame
 L1     0101100101110100101010010101001010101010101...            = Bits
Layer Header adds Example value
Transport (L4) Source and destination port 51544 → 443
Network (L3) Source and destination IP, TTL 192.​168.​1.​10 → 203.​0.​113.​10
Data Link (L2) Source and destination MAC, FCS trailer 0a:​1b:​2c:​3d:​4e:​5f → router MAC

Wireshark madhe ek packet open kela ki exactly hech layers khalun var distat – Frame, Ethernet II, Internet Protocol, TCP, HTTP. Mhanun encapsulation samjla tar Wireshark aapoaap samjel.

Why this matters for security

Every header is a field an attacker can forge or read: a spoofed source IP (L3), a fake MAC in ARP spoofing (L2), crafted TCP flags in stealth scans (L4). Packet filters read L3/L4 headers only; a WAF reads the L7 payload. Knowing which header a control inspects tells you what it can and cannot stop – and never trust a header just because it is present.

Ravindra Bagale's Tip

Many students mix up the PDU names and use "packet" for every layer. Be precise in interviews: L4 = segment (TCP) / datagram (UDP), L3 = packet, L2 = frame, L1 = bits. This small distinction shows that your concepts are clear.

Practice task

First, on paper, write the headers that are added to an HTTP request as it travels from L7 down to L2, and the address or number each header contains. Then open any capture in Wireshark (or the sample captures on the Wireshark wiki), click one HTTP packet and check your answer: note the source/destination MAC, IP and port from the three header sections.