1.5. Encapsulation: Data Wrapping at Each Layer

💡 First Principle: As data travels down the protocol stack, each layer wraps the data from the layer above with its own header (and sometimes trailer)—like putting a letter in an envelope, then putting that envelope in a box, then putting the box in a shipping container. Each layer only looks at its own wrapper; the inner contents are opaque.

Why does this matter for troubleshooting? When something breaks, encapsulation tells you where to look. If the MAC address is wrong, it's a Layer 2 problem—check switch ports, VLANs, ARP. If the IP address is wrong, it's a Layer 3 problem—check routing, NAT, subnets. The layer determines the tools and commands you use.

Consider this scenario: A user can ping servers on the local subnet but nothing beyond. What layer is the problem? Since local communication (Layer 2) works but remote (Layer 3) fails, you know to check the default gateway, routing tables, or NAT—not the switch or cabling. Encapsulation gives you a mental framework for isolation.

Loading diagram...

PDU Names by Layer:

Ethernet Frame Structure (Layer 2):

Loading diagram...

⚠️ Exam Trap: The Type field in an Ethernet frame indicates the Layer 3 protocol (0x0800 = IPv4, 0x86DD = IPv6, 0x0806 = ARP). This is how a switch knows what to do with the frame.