The idea
You have a document to send to someone in another country. You put it in an envelope with their name on it. Your mailroom puts that envelope in a sack addressed to the destination city’s sorting office. The airline puts that sack in a container addressed to the destination airport.
Three wrappers, three different addresses, three different scopes. The container address is useless once the plane lands — it gets discarded and the sack address takes over. The name on the innermost envelope never changes, because that is the only address that identifies the actual recipient.
Networking does the same thing, for the same reason, and the “the outer address changes, the inner one does not” part is the idea this whole topic turns on.
Encapsulation
How it works
Wrapping on the way down, unwrapping on the way up
Each layer in the sending device adds its own information to the message it receives from the layer just above, then passes the whole package to the layer just below. That is encapsulation.
At the receiving machine the message is unwrapped layer by layer, each process receiving and removing the part meant for it — and handing the rest upward.
ApplicationData
TransportSegment
NetworkDatagram
Data LinkFrame
Each layer treats everything above it as opaque payload. That is the whole idea of layering — the data link layer never needs to know an HTTP request is in there.
The package gets a new name at each step, and the exam uses those names:
| Layer | What it hands down | What it adds |
|---|---|---|
| Application / presentation / session | Data | Application headers |
| Transport | Segment | Port numbers, sequence numbers |
| Network | Datagram (packet) | Logical (IP) source and destination |
| Data link | Frame | Physical (MAC) addresses, and a trailer for error checking |
| Physical | Bits | Encoding onto the medium |
The point of the standard interface between layers is exactly this: each interface defines what information and which services a layer must provide to the layer above it. Nothing above the data link layer needs to know an Ethernet frame exists.
Aside
This is also why a packet capture in the lab looks like a set of nested boxes. Wireshark is showing you the encapsulation directly — click a layer and it highlights the bytes that layer added. Lab 1 is built around exactly this.
Four kinds of address
TCP/IP uses four levels of address: physical, logical, port and specific. They differ in scope, and — more importantly for the exam — in whether they change in transit.
| Address | Layer | Scope | Changes in transit? |
|---|---|---|---|
| Physical (MAC) | Data link | One link only | Yes — at every hop |
| Logical (IP) | Network | The whole internet | No |
| Port | Transport | One host's processes | No |
| Specific | Application | Human-facing | No |
Logical addresses
A logical address is needed for end-to-end universal communication
independent of the underlying physical networks. In IPv4 it is 32 bits,
written as four decimal octets — 192.168.10.5. No two publicly connected
addresses may be the same.
The property that matters: the physical address may change hop to hop, but the logical address usually remains the same for the whole journey.
Port addresses
A port address is the label assigned to a specific process or application. In TCP/IP it is 16 bits. The well-known ones the lecture lists:
| Service | Port |
|---|---|
| HTTP | 80 |
| FTP | 21 |
| Telnet | 23 |
| DNS | 53 |
FTP is worth one extra note: 21 carries the control channel — the commands —
while 20 carries the actual data. A question asking “which port does FTP use”
has two defensible answers, so say both and say which is which.
Like the logical address, the port address normally stays the same end to end.
Where marks get lost
The classic question gives a path across several routers and asks what changes.
Answer with the mechanism, not just the fact. The physical address is only meaningful on one link — the next router along has no idea what a MAC address three networks away refers to. So each hop needs a fresh destination MAC: the one belonging to the next device on this wire. The logical address survives because it names the final destination, which does not move.
A path crossing n links uses n different destination physical addresses and one destination logical address.
Where ARP comes in
That leaves an obvious gap. A router knows the next hop’s logical address — routing gave it that. But to build a frame it needs the next hop’s physical address. Nothing so far provides it.
The Address Resolution Protocol fills exactly that gap. It broadcasts a query on the local network — who has this IP address? — and the machine that owns it replies with its MAC address.
Notice where that leaves ARP: it consumes a network-layer address and produces a data-link-layer address, so it belongs cleanly to neither. Different textbooks place it in different layers, and it is not worth agonising over. It is covered properly in Module 3, and Lab 1 has you watch a real ARP request and reply in Wireshark.
Check yourself
Two questions to check yourself on before moving on.
- Why can a router not simply use the destination’s MAC address directly and skip all this?
- If the port address never changes in transit, why does the frame not carry it?
For the second: the port lives in the transport header, which is inside the datagram, which is inside the frame. The data link layer never looks at it — that is layering doing its job.
In the exam
- Describe encapsulation. Each layer adds its own information to what it gets from above and passes the whole thing down; the receiver reverses it. Name the PDUs: data, segment, datagram, frame, bits.
- Distinguish the four address types. Give the layer, the scope, and whether it changes in transit. Four levels: physical, logical, port, specific.
- The changes-in-transit question. Physical changes every hop; logical and port do not. Explain why — a MAC address only has meaning on one link.
- Logical address size: 32 bits in IPv4. Port address size: 16 bits. Both are asked directly.
- What ARP does. Maps a logical address to a physical one, by broadcast on the local network.