When an application sends data, the data does not travel as-is. Each layer of the stack prepends its own header (and, at layer 2, also appends a trailer) containing the control information its peer layer on the receiving side needs. This wrapping process is encapsulation; the receiver reverses it, layer by layer, as de-encapsulation. Understanding exactly what gets added where is the difference between reading a packet capture fluently and guessing.
Protocol Data Units at each layer
The name of the data unit changes at each layer, and the exam answer and the wireshark view agree on these names:
- Layers 5–7 — data: the application payload, e.g. an HTTP GET request.
- Layer 4 — segment (TCP) or datagram (UDP): payload plus a transport header carrying source and destination ports, and for TCP sequence numbers, ACKs and window size.
- Layer 3 — packet: the segment plus an IP header with source and destination IP addresses, TTL and protocol number (6 = TCP, 17 = UDP).
- Layer 2 — frame: the packet plus an Ethernet header (destination MAC, source MAC, EtherType) and a 4-byte FCS trailer.
- Layer 1 — bits: the frame encoded onto the medium as electrical, optical or radio symbols.
The critical behaviour: what changes hop by hop
On a routed path, layer-3 addressing is end-to-end while layer-2 addressing is hop-by-hop. The source and destination IP addresses in the packet header normally stay constant for the entire journey (NAT aside). The MAC addresses in the frame are rewritten at every router: each router strips the incoming frame, decrements the TTL, and builds a brand-new frame whose source MAC is its own egress interface and whose destination MAC is the next hop — resolved via ARP. This one fact explains most 'why is the destination MAC the router and not the server?' confusion in packet captures.
OSI vs the TCP/IP model
The TCP/IP (DoD) model describes the protocol suite the Internet actually runs, in four layers: Network Access (OSI 1–2), Internet (OSI 3), Transport (OSI 4) and Application (OSI 5–7). The modern five-layer teaching model splits Network Access back into Physical and Data Link because switching and cabling are such distinct disciplines.
In practice engineers speak OSI numbers while running TCP/IP protocols — 'layer 3 switch', 'layer 7 firewall'. The OSI model is the vocabulary; TCP/IP is the implementation. Session, Presentation and Application exist as distinct OSI layers, but in captures you will simply see TLS and HTTP nested inside TCP.
Reading a real capture
A single browser request to a web server, viewed in Wireshark, decodes from the bottom up exactly along these lines:
Frame 42: 583 bytes on wireEthernet II, Src: aa:bb:cc:11:22:33, Dst: d4:6d:50:aa:01:02Internet Protocol Version 4, Src: 192.168.1.10, Dst: 203.0.113.80Transmission Control Protocol, Src Port: 51844, Dst Port: 443Transport Layer Security — Application Data
Each indented line in the capture is one layer of encapsulation. When you can predict every field of that decode before opening it — which MACs, which IPs, which ports — encapsulation has done its job as a mental model, and troubleshooting any hop of any path becomes a matter of asking 'which header would be wrong here?'.