📦 01-03: TCP/IP Model & Encapsulation¶
📌 What Is the TCP/IP Model?¶
The TCP/IP model (also called the Internet Protocol Suite) is the practical, 4-layer model that the real internet actually runs on. Unlike the 7-layer OSI model (01-02: OSI Model Recap), which is a theoretical teaching framework, TCP/IP was built by engineers solving real problems — so its layers map to actual protocols in actual use today.
💡 If OSI is the "textbook diagram," TCP/IP is "the actual internet." Both describe the same underlying reality; they just draw the boundaries differently.
🔢 The 4 Layers¶
| TCP/IP Layer | PDU Name | Job | Example Protocols |
|---|---|---|---|
| Application | Data | User-facing protocols and session/encoding logic | HTTP, HTTPS, DNS, FTP, SMTP, TLS |
| Transport | Segment (TCP) / Datagram (UDP) | End-to-end delivery between the correct applications | TCP, UDP |
| Internet | Packet | Logical addressing and routing across networks | IP, ICMP |
| Network Access (a.k.a. Link) | Frame → Bits | Physical addressing and transmission on the local medium | Ethernet, Wi-Fi, ARP |
🔗 Mapping TCP/IP onto OSI¶
| OSI Layer | TCP/IP Layer |
|---|---|
| 7 — Application | Application |
| 6 — Presentation | Application |
| 5 — Session | Application |
| 4 — Transport | Transport |
| 3 — Network | Internet |
| 2 — Data Link | Network Access |
| 1 — Physical | Network Access |
💡 The TCP/IP model simply collapses OSI's top three layers into one "Application" layer, and its bottom two layers into one "Network Access" layer. It doesn't disagree with OSI conceptually — it just doesn't bother separating concerns (like encryption vs. session management) that, in practice, real protocols like TLS and HTTP handle together anyway.
🚚 Encapsulation: A Full Worked Example¶
Let's trace a real HTTP GET request from your browser all the way down to the bits sent over the wire.
Scenario: Your browser wants GET /index.html from a web server.
Step 1 — Application Layer: HTTP Data¶
The browser builds the raw HTTP request:
This is just text — the Application Data. At this point it has no addressing information at all.
Step 2 — Transport Layer: Wrap in a TCP Segment¶
The Transport layer adds a TCP header containing, among other things, the source port (randomly chosen, e.g., 51000) and destination port (80 for HTTP), plus sequence numbers for reliability (see 02-01: TCP Fundamentals & Handshake).
This whole unit is now called a segment.
Step 3 — Internet Layer: Wrap in an IP Packet¶
The Internet layer adds an IP header containing the source IP (your computer) and destination IP (the web server), among other fields (TTL, protocol number, checksum).
This whole unit is now called a packet.
Step 4 — Network Access Layer: Wrap in an Ethernet Frame¶
The Network Access layer adds an Ethernet header containing the source MAC address (your NIC) and destination MAC address — which, for traffic leaving your local network, is actually the MAC address of your default gateway (router), not the final web server. It also appends a trailer (Frame Check Sequence, for error detection).
[ Ethernet Header (src MAC AA:BB:.., dst MAC = router's MAC) | IP Header | TCP Header | HTTP Data | Ethernet Trailer ]
This whole unit is now called a frame.
Step 5 — Physical Layer: Convert to Bits¶
Finally, the frame is converted into electrical signals, light pulses, or radio waves and transmitted onto the medium as a stream of bits.
📊 ASCII Diagram — Full Stack¶
Application | GET /index.html HTTP/1.1 ...
|----------------------------------------------------------
Transport | [TCP Header] | GET /index.html HTTP/1.1 ...
|----------------------------------------------------------
Internet | [IP Header] [TCP Header] | GET /index.html HTTP/1.1 ...
|----------------------------------------------------------
Network Acc. | [Eth Header] [IP Header] [TCP Header] | HTTP Data | [Trailer]
|----------------------------------------------------------
Physical | 0100010101101011000011110101101010101101011...
Each layer only understands its own header — a switch reads the Ethernet header, a router reads the IP header, the receiving OS's TCP stack reads the TCP header, and only the final application reads the HTTP data itself.
🔄 Decapsulation: The Reverse Journey¶
On the receiving server, the exact same process happens in reverse — the frame arrives as bits, and each layer strips off (and processes) its own header before passing what's left "up" to the next layer:
Bits → [strip Ethernet header/trailer] → Frame becomes a Packet
Packet → [strip IP header] → Packet becomes a Segment
Segment → [strip TCP header] → Segment becomes raw Application Data
Application Data → handed to the web server process (e.g., Apache/nginx)
At each step, the header tells that layer what to do next:
- The Ethernet header tells the NIC "this frame is addressed to my MAC — accept it, and hand the payload up."
- The IP header tells the OS "this packet is addressed to my IP, and the next header is TCP — hand it to the TCP stack."
- The TCP header tells the TCP stack "this segment is for port 80 — hand it to whatever application is listening on that port," and also handles putting bytes back in the correct order using sequence numbers.
- The HTTP data is finally handed to the actual web server software to generate a response.
💡 Security relevance: every one of these headers is a potential attack surface, because nothing forces any of these fields to be truthful. An attacker with the right tools (like Scapy) can hand-craft a frame with a forged source MAC, a packet with a forged source IP, or a segment with forged sequence numbers — this is the foundation of spoofing attacks covered starting in 02-06: IP Spoofing Fundamentals.
🧩 Why Understanding This Matters for Reading Packet Captures¶
When you open Wireshark or tcpdump later (02-05: Reading Packets — Wireshark & tcpdump), you'll see packets displayed with all their headers nested and labeled exactly like this diagram — Wireshark literally shows you "Frame → Ethernet → IP → TCP → HTTP" as collapsible layers, one inside the other. Understanding encapsulation is understanding how to read that display.
📌 Key Takeaways¶
- The TCP/IP model has 4 layers: Application, Transport, Internet, Network Access — it's what the real internet actually implements.
- TCP/IP's Application layer absorbs OSI's Application + Presentation + Session layers; its Network Access layer absorbs OSI's Data Link + Physical layers.
- Encapsulation wraps data in a new header at each layer going down: HTTP data → TCP segment → IP packet → Ethernet frame → bits.
- Decapsulation is the exact reverse on the receiving side, with each layer stripping its own header and passing the payload up.
- Ethernet frames leaving the local network are addressed (at Layer 2) to the default gateway's MAC address, not the final destination's MAC.
- Every header field added during encapsulation (source IP, source MAC, sequence numbers) can potentially be forged — this is the root cause behind most spoofing attacks covered later in the course.
- Reading a packet capture in Wireshark is really just reading the encapsulation stack in reverse, layer by layer.