Back to Blog
NetworkingDevOpsInfrastructureBackendSystem ArchitectureSecurity

The OSI Model: A Deep Dive into Network Encapsulation

Written by Dev Toolkit Editorial
•
July 8, 2026
•11 MIN READ

A deep technical analysis of network encapsulation and decapsulation—examining layer-by-layer header construction, PDUs, MSS/MTU calculations, Ethernet frames, and wire-level bit serialization.

When a web application executes an API call, fetches a database record, or transmits a telemetry event, human-readable data undergoes a rigorous sequence of structural transformations. Before a single electrical pulse, light wave, or radio signal traverses a physical medium, the underlying data is processed through the network stack, conceptually categorized by the Open Systems Interconnection (OSI) reference model. While modern operating systems implement the practical four-layer TCP/IP suite (Link, Internet, Transport, Application), the seven-layer OSI model provides a standardized architectural baseline to analyze packet construction.

At each stage of this journey, operating system network stacks, protocol engines, and hardware controllers attach control metadata—a process known as Data Encapsulation. Conversely, when the target host receives these signals, it strips these headers layer by layer in a process known as Decapsulation.

Understanding network encapsulation is fundamental for systems engineers, backend developers, and cloud architects diagnosing packet drops, MTU mismatches, latency bottlenecks, and network security perimeters.

For an overarching review of all seven OSI layers, consult our companion guide on Understanding the OSI Model.

OSI Model Data Encapsulation Pipeline Flowchart

What Is Network Encapsulation?

Encapsulation is the structural abstraction mechanism by which higher-layer protocol data is wrapped inside lower-layer control structures.

In the OSI reference framework, every layer defines a specific Protocol Data Unit (PDU). As data flows down the protocol stack on the transmitting host:

  1. Upper Layers (7 to 5) prepare the raw payload (Data).
  2. Layer 4 (Transport) prepends port numbers and transport controls (Segment or Datagram).
  3. Layer 3 (Network) prepends logical source and destination IP addresses (Packet).
  4. Layer 2 (Data Link) prepends physical MAC addresses and appends a Frame Check Sequence trailer (Frame).
  5. Layer 1 (Physical) encodes the frame into raw binary signals (Bits).

Each layer treats the entire PDU received from the layer directly above it as opaque data—prepending its own header (and in Layer 2’s case, appending a trailer) without parsing the higher-layer contents.

Layer-by-Layer Encapsulation Pipeline

Let’s trace an outbound HTTPS request containing a JSON body as it moves step by step through the encapsulation pipeline.

1. Layers 7–5: Application, Presentation, and Session Layers

  • PDU Name: Application Data / Payload

At the top of the stack, the application generates raw payload data (e.g., an HTTP/2 POST request formatted in JSON).

In practical TCP/IP implementations, the Application, Presentation, and Session layers are consolidated into a single Application layer. Modern operating system stacks do not maintain separate Presentation or Session layer protocols:

  • Layer 7 (Application): Software protocols such as HTTP, DNS, gRPC, or SMTP construct the structured message. If the request requires percent-encoded URL parameters, characters are escaped prior to serialization using tools like our URL Encoder & Decoder.
  • Layer 6 (Presentation): In the OSI model, handles data representation, formatting, compression, and character set conversion (e.g., UTF-8). In practice, these functions are handled directly by application-level protocols or libraries (e.g., TLS for encryption, Protobuf, JSON, or gRPC for serialization). When binary payload fields or cryptographic signatures are transmitted over text-oriented protocols, they are converted into ASCII sequences using standard encoders like our Base64 Encoder & Decoder. To explore the differences between encoding, hashing, and encryption, read our guide on Base64 Encoding, Hashing, and Encryption.
  • Layer 5 (Session): Defines concepts for application-level session establishment, maintenance, synchronization, checkpointing, and teardown (functions typically embedded within higher-level protocols like TLS, HTTP/2, or gRPC streams rather than a standalone kernel session layer).
+-----------------------------------------------------------------------+
| Application Data Payload (e.g., "GET /api/v1/users HTTP/1.1\r\n...")  |
+-----------------------------------------------------------------------+

2. Layer 4: Transport Layer

  • PDU Name: Segment (TCP) or Datagram (UDP)

The operating system kernel’s network stack receives the application payload and encapsulates it within a transport header.

For TCP (Transmission Control Protocol), the Layer 4 header (minimum 20 bytes) contains:

  • Source Port (e.g., 52100) and Destination Port (e.g., 443 for HTTPS).
  • Sequence Number and Acknowledgment Number for ordered byte-stream delivery.
  • TCP Flags (SYN, ACK, FIN, RST, PSH).
  • Window Size for flow control and sliding window management.
  • Checksum verifying pseudo-header and segment integrity.

Maximum Segment Size (MSS) Advertised Option

To avoid fragmentation at the IP layer, TCP advertises its Maximum Segment Size (MSS) option in the TCP header during the initial 3-way handshake (SYN and SYN-ACK exchange). The advertised value is typically derived from the local interface Maximum Transmission Unit (MTU) minus the fixed IP and TCP header overheads:

$$\text{MSS} = \text{MTU} - H_{\text{IP}} - H_{\text{TCP}}$$

Where \(\text{MTU}\) is typically 1,500 bytes on standard Ethernet, \(H_{\text{IP}}\) is 20 bytes for IPv4, and \(H_{\text{TCP}}\) is 20 bytes, yielding a default advertised IPv4 MSS of 1,460 bytes.

+------------------+----------------------------------------------------+
| TCP Header       | Application Data Payload                           |
| (Ports, Seq, Ack)|                                                    |
+------------------+----------------------------------------------------+
|<----------------------- L4 TCP Segment ------------------------------>|

To learn how Layer 4 load balancers route TCP segments based on port tuples without decrypting payload contents, read our guide on Layer 4 vs Layer 7 Load Balancing.

3. Layer 3: Network Layer

  • PDU Name: Packet

The Layer 4 segment is passed down to Layer 3, where the network protocol (IPv4 or IPv6) wraps it in an IP header (minimum 20 bytes for IPv4).

The IPv4 header includes:

  • Source IP Address (e.g., 192.168.1.50) and Destination IP Address (e.g., 198.51.100.25).
  • Time to Live (TTL): Prevents endless routing loops by decrementing at every hop.
  • Protocol Identifier: Specifies the inner protocol (6 for TCP, 17 for UDP, 1 for ICMP).
  • Header Checksum: Verifies IP header integrity.
  • Identification, Flags, and Fragment Offset: Manages packet fragmentation if the packet size exceeds an intermediate link’s MTU.
+------------------+------------------+---------------------------------+
| IP Header        | TCP Header       | Application Data Payload        |
| (Src/Dst IP, TTL)| (Ports, Seq, Ack)|                                 |
+------------------+------------------+---------------------------------+
|<------------------------- L3 IP Packet ------------------------------>|

To see how routers modify IP headers during egress, see our deep dive on Understanding Network Address Translation: SNAT, DNAT, CGNAT, or explore host boundaries in Demystifying Subnetting, CIDR Notation, and IP Addressing.

  • PDU Name: Frame

The IP packet is handed down to the operating system’s networking stack, which constructs the Data Link frame (e.g., Ethernet II). Modern NICs and drivers may also perform hardware offloading tasks, such as checksum offload or TCP Segmentation Offload (TSO / GSO), where large payloads are passed to the NIC hardware to be split and framed at wire speed.

An Ethernet II frame contains both a header (14 bytes) and a trailer (4 bytes):

  • Destination MAC Address (6 bytes): Resolved via ARP (IPv4) or NDP (IPv6) to determine the physical address of the next-hop interface—which is either the destination host (if on the same local subnet) or the default gateway router (if on a different subnet).
  • Source MAC Address (6 bytes): Physical address of the transmitting NIC interface.
  • EtherType (2 bytes): Identifies the inner Layer 3 protocol (0x0800 for IPv4, 0x86DD for IPv6).
  • Frame Check Sequence (FCS) (4 bytes): A Cyclic Redundancy Check (CRC32) trailer appended to the end of the frame to detect bit-level corruption during physical transmission.
+---------------+------------------+------------------+-----------------+---------------+
| Ethernet Hdr  | IP Header        | TCP Header       | App Payload     | FCS Trailer   |
| (Src/Dst MAC) | (Src/Dst IP, TTL)| (Ports, Seq, Ack)|                 | (CRC32)       |
+---------------+------------------+------------------+-----------------+---------------+
|<----------------------------------- L2 Ethernet Frame ------------------------------->|

5. Layer 1: Physical Layer

  • PDU Name: Bits

Finally, the hardware controller on the physical Network Interface Card converts the framed binary byte sequence into physical signals suitable for the transmission medium. The exact physical line encoding scheme depends on the specific Ethernet standard:

  • Copper Cable (RJ-45): Voltage transitions using encoding schemes such as Manchester (10BASE-T), MLT-3 (100BASE-TX), PAM-5 (1000BASE-T), or PAM-16 (10GBASE-T).
  • Fiber Optic Cable: Light pulses transmitted over single-mode or multi-mode optical fiber using non-return-to-zero (NRZ) or 8b/10b encoding.
  • Wireless (Wi-Fi / Cellular): Radio frequency modulation using QAM or OFDM techniques.

Before Ethernet frame transmission begins on the wire, Layer 1 prepends a 7-byte preamble and a 1-byte Start Frame Delimiter (SFD)—specific to Ethernet standards—to synchronize bit timing on the receiving PHY chip.

The Decapsulation Process at the Destination

When physical signals arrive at the destination network adapter, the process is inverted—a sequence called Decapsulation:

  1. L1 Physical: The receiving PHY hardware deserializes incoming signals back into a binary bitstream, strips the preamble, and reconstructs the Ethernet frame.
  2. L2 Data Link: The NIC hardware calculates the CRC32 checksum over the frame data and compares it against the FCS trailer.
    • If checksums mismatch, the corrupted frame is typically discarded by the NIC or network driver before reaching the operating system networking stack.
    • If valid, the MAC destination address is verified (matching the local NIC or promiscuous/multicast mode). The MAC header and FCS trailer are stripped, and the payload is handed up to Layer 3 based on the EtherType field.
  3. L3 Network: The operating system’s IP stack verifies the destination IP address and IP header checksum. The TTL is checked, the IP header is stripped, and the payload is routed to the transport layer indicated by the Protocol field (6 = TCP).
  4. L4 Transport: The TCP engine verifies segment checksums, processes sequence/ack numbers, updates flow control state, strips the TCP header, and buffers the payload into the appropriate socket receive buffer based on the Destination Port.
  5. L7-L5 Application: The application reads the raw byte stream from the socket descriptor, parses protocol parameters, decodes representations, and processes the request.

Intermediate Device Inspection Levels

Not all network devices process packets all the way up to Layer 7:

+----------------------+-------------------------------------------------------------------+
| Network Device Class | Highest OSI Layer Inspected                                       |
+----------------------+-------------------------------------------------------------------+
| L1 Repeater / Hub    | Layer 1 (Physical signals only)                                   |
| L2 Switch / Bridge   | Layer 2 (MAC Addresses, Ethernet Frames)                          |
| L3 Router / Gateway  | Layer 3 (IP Addresses, TTL, Route Lookup)                         |
| L4 Load Balancer     | Layer 4 (TCP/UDP Ports, Connection Tracking)                      |
| L7 Proxy / WAF       | Layer 7 (HTTP Headers, TLS, Application Payload after TLS decryption)|
+----------------------+-------------------------------------------------------------------+

When an intermediate L3 router forwards a packet across subnets, it strips and replaces the Layer 2 Ethernet frame (updating source/destination MAC addresses for the next-hop interface) while leaving the Layer 3 IP packet intact (except for decrementing the TTL and recalculating the IP header checksum).

PDU & Header Summary Matrix

$$\text{Total Frame Size} = \text{Eth Header} + \text{IP Header} + \text{TCP Header} + \text{Payload} + \text{FCS}$$

OSI Layer Layer Name Protocol Data Unit (PDU) Primary Addressing / Identifiers Typical Overhead
Layer 7 Application Data / Payload HTTP URLs, RPC Methods, DNS Names Varies by protocol
Layer 6 Presentation Data Character sets, MIME types, Encodings Varies (e.g., Base64 (~33% size increase))
Layer 5 Session Data Session IDs, RPC Contexts Protocol dependent
Layer 4 Transport Segment / Datagram TCP / UDP Port Numbers (0–65535) 20 B (TCP) / 8 B (UDP)
Layer 3 Network Packet Source & Destination IP Addresses 20 B (IPv4) / 40 B (IPv6)
Layer 2 Data Link Frame Source & Destination MAC Addresses 14 B Header + 4 B FCS
Layer 1 Physical Bits Voltage levels, Light pulses, Frequencies 8 B Preamble/SFD

Conclusion

Data encapsulation is the unifying architectural principle that allows disparate software applications, operating systems, and physical hardware devices to seamlessly communicate across global networks.

By systematically wrapping payloads in transport, network, and data link control structures, the internet achieves modularity, scalability, and robust error detection. Mastering encapsulation mechanics empowers developers and systems engineers to pinpoint network faults, optimize throughput, and design resilient distributed architectures.

Related Guides & Reference Materials