Ravi Sir's Cyber Security Cards › Revision Cards
Encapsulation and Decapsulation
Encapsulation and Decapsulation Encapsulation : each layer adds its own header as data goes down to the wire, like putting a letter in envelopes. Decapsulation : the receiver removes the headers one by one. Layer 4 = segment (TCP) or datagram (UDP). Layer 3 = packet . Layer 2 = frame . Attackers can
Read card text
What this card says
What it is
Encapsulation: each layer adds its own header as data goes down to the wire, like putting a letter in envelopes.
Decapsulation: the receiver removes the headers one by one.
Names at each layer
Layer 4 = segment (TCP) or datagram (UDP). Layer 3 = packet. Layer 2 = frame.
Why it matters for security
Attackers can fake headers: a spoofed source IP (layer 3), a fake MAC in ARP spoofing (layer 2).
A packet filter reads layer 3/4 headers. A WAF (web application firewall) reads layer 7 content.
Key lesson
Never trust a header just because it is there.
| Layer | Header adds | Example value |
|---|---|---|
| Transport (L4) | Source and destination port | 51544 → 443 |
| Network (L3) | Source and destination IP, TTL | 192.168.1.10 → 203.0.113.10 |
| Data Link (L2) | Source and destination MAC, FCS trailer | 0a:1b:2c:3d:4e:5f → router MAC |
Learn more in the lesson: 3.2 Encapsulation and Decapsulation