Packets, Frames, Encapsulation

Updated

September 4, 2026

Packets, Frames, Encapsulation

Data is wrapped in headers as it descends the stack and unwrapped on the way up. Clear names prevent confusion in captures and design talks.

Learning goals

  • Use correct terms: data, segment/datagram, packet, frame
  • Sketch encapsulation for a simple TCP and UDP flow
  • Read a tcpdump line and identify outer headers
  • Explain how tunnels add outer encapsulations

Vocabulary

Term Layer (typical) Meaning
Data / payload Application What the app cares about
Segment TCP TCP header + payload
Datagram UDP (and sometimes IP) UDP header + payload
Packet IP IP header + payload
Frame Link Ethernet (or other) header + payload + FCS

People say “packet” loosely; in precise talk, frame is L2 and packet is L3.

Encapsulation path (send)

  1. Application writes bytes
  2. Transport adds src/dst ports (TCP adds seq/ack/flags)
  3. IP adds src/dst IP, TTL, protocol
  4. Ethernet adds src/dst MAC, Ethertype
  5. Bits go on the wire (or veth)
 Application data
+------------------+
| TCP/UDP header   |
+------------------+
| IP header        |
+------------------+
| Ethernet header  |
+------------------+

Decapsulation path (receive)

Reverse order: FCS check → MAC → Ethertype → IP → protocol → ports → app.

Maximum sizes and MTU

  • MTU: max IP packet size a link will accept (commonly 1500 on Ethernet)
  • Larger packets must fragment (IPv4) or fail with Packet Too Big (IPv6 + PMTUD)
  • Extra encapsulation (VLAN tag, VXLAN, IPsec) reduces effective payload size

Details and labs: Layer 3 ICMP/PMTU chapter later; foundations need the idea.

Captures: reading the onion

# On a Linux lab node
tcpdump -ni eth1 -vv
tcpdump -ni eth1 icmp
tcpdump -ni eth1 'tcp port 22'

What you see first is the outer header. Inner headers appear after decap or when capturing on the right interface.

Tunnels and overlays (preview)

Overlays wrap an inner packet in an outer IP/UDP (or GRE) packet. Underlay routers only need to forward the outer packet. Full treatment: Overlays part.

[ Outer Eth | Outer IP | Outer UDP | VXLAN | Inner Eth | Inner IP | … ]

Lab sketch (two nodes)

  1. Deploy two Linux nodes on one L2 segment
  2. Capture while ping runs — ICMP inside IP inside Ethernet
  3. Capture nc or curl — TCP three-way handshake fields

Checkpoint

Draw encapsulation for DNS over UDP and SSH over TCP from host A to B on the same Ethernet. Label every header.

Next