3. OSI Model, TCP/IP Model, TCP vs UDP and the 3-Way Handshake
3.2 Encapsulation and Decapsulation
Mitrano, data khali jatana (sender side) pratyek layer swatahcha header laavto – jasa parcel var ek ek label chikatavla jato. Receiver side la ulta hota – pratyek layer aapla label kadhun data varchya layer la deto. Yala encapsulation (आवरण घालणे) aani decapsulation mhantat.
As data moves down, each layer adds its own header (Layer 2 also adds a trailer):
L7-5 [ HTTP data ]
L4 [TCP hdr: ports ][ HTTP data ] = Segment
L3 [IP hdr: IPs][TCP hdr][ HTTP data ] = Packet
L2 [Eth hdr: MACs][IP][TCP][ HTTP data ][FCS] = Frame
L1 0101100101110100101010010101001010101010101... = Bits
| Layer | Header adds | Example value |
|---|---|---|
| Transport (L4) | Source and destination port | 51544 → 443 |
| Network (L3) | Source and destination IP, TTL | 192.168.1.10 → 203.0.113.10 |
| Data Link (L2) | Source and destination MAC, FCS trailer | 0a:1b:2c:3d:4e:5f → router MAC |
Wireshark madhe ek packet open kela ki exactly hech layers khalun var distat – Frame, Ethernet II, Internet Protocol, TCP, HTTP. Mhanun encapsulation samjla tar Wireshark aapoaap samjel.
Why this matters for security
Every header is a field an attacker can forge or read: a spoofed source IP (L3), a fake MAC in ARP spoofing (L2), crafted TCP flags in stealth scans (L4). Packet filters read L3/L4 headers only; a WAF reads the L7 payload. Knowing which header a control inspects tells you what it can and cannot stop – and never trust a header just because it is present.
Ravindra Bagale's Tip
Khup students PDU chi naave gondhaltat – "packet" sagalya layers sathi vaprtat. Interview madhe precise raha: L4 = segment (TCP) / datagram (UDP), L3 = packet, L2 = frame, L1 = bits. Ha chhota farak tumcha concept clear aahe he dakhavto.
Practice task
First, on paper, write the headers that are added to an HTTP request as it travels from L7 down to L2, and the address or number each header contains. Then open any capture in Wireshark (or the sample captures on the Wireshark wiki), click one HTTP packet and check your answer: note the source/destination MAC, IP and port from the three header sections.