Encapsulation: Each Layer Wraps the One Above

Encapsulation is how the layers of a network stack cooperate: on the sending machine each layer takes the data from the layer above and wraps it in its own header, and on the receiving machine each layer reads and removes its header before passing the rest up. It is the reason one layer can change without the others noticing.

A header is a small block of fields written in front of the data, such as the addresses the data is going to and from. When a browser sends a request, the request is just bytes to the transport layer, which puts a TCP header in front of them. The network layer treats the TCP header and the request together as its data, and puts an IP header in front of both. The data link layer does the same with an Ethernet header, and adds a short trailer at the end that lets the receiver detect damage. The physical layer then sends the whole thing as bits.

Each layer reads only its own header: the web server never sees the Ethernet header at all. A header is a private conversation between the same layer on two machines, which is what keeps the layers independent.

A letter in nested envelopes is a fair picture. The innermost envelope is addressed to a person in an office, the next to the office's building, the outer one to the postal sorting centre, and each is opened by whoever it is addressed to. The picture breaks at one point that matters later: a posted letter keeps its envelopes until it arrives, but every router on the way removes the outermost header, the frame, and writes a new one for the next link.

So a packet capture taken on any one link shows the full stack of headers, and knowing their order tells you which part of a fault each header can explain.