Network layers, services and encapsulation
Goals and model
Explain what a layer provides, distinguish a service from a protocol, and trace headers across a routed path. Prerequisites: bits, bytes and binary arithmetic. We use ordinary unicast IPv4 over Ethernet, with no tunnelling, NAT, VLAN tags, IP options or fragmentation unless a question says otherwise. Sizes are stated explicitly; do not silently add a preamble or inter-frame gap to a frame-size calculation.
1. Why layering helps
A layer offers a service to the layer above and uses the layer below. A protocol defines rules and message formats between peer entities; a service interface describes what a local user of that layer may request. An application can ask a transport implementation to send bytes without implementing the network card's signalling. The peer relationship is logical: data physically travels down the sender's stack, through links and intermediate devices, then up the receiver's stack.
The OSI reference model has seven layers, bottom to top: physical (signals/bits), data link (frames on a link), network (internetwork packet forwarding), transport (process-to-process communication), session (dialogue coordination), presentation (representation/encoding), application (application protocols). These are functional categories, not a requirement that every Internet application implements seven distinct software modules.
The four-layer TCP/IP model groups link, Internet, transport and application. A five-layer teaching model separates physical from link. State the convention before counting layers. OSI session/presentation functions generally reside with applications or libraries in the Internet architecture; they do not create mandatory separate Internet headers. TCP and UDP are transport protocols; IP is Internet-layer; Ethernet is link-layer. DNS and HTTP are application protocols.
2. Encapsulation and demultiplexing
Each participating lower layer treats the higher-layer unit as payload and adds its own control information, sometimes including a trailer. At the receiver, fields guide demultiplexing: Ethernet EtherType selects the network protocol; the IPv4 Protocol field selects transport, such as TCP or UDP; destination ports help select the receiving endpoint/application. A port is not an IP address and an Ethernet address is not a transport port.
Worked accounting: an application supplies 1000 bytes. With a 20-byte TCP header and 20-byte IPv4 header, the TCP segment is 1020 bytes and the IP datagram is 1040 bytes. Adding an explicitly specified 14-byte Ethernet header and 4-byte FCS gives 1058 bytes from destination MAC through FCS. Application-data fraction=1000/1058≈94.52%. This is not physical-wire utilization: preamble, inter-frame gap, ACKs and retransmissions were excluded. IP total length includes its header but excludes Ethernet overhead; Ethernet's FCS is error detection, not application data.
3. Follow one packet across a router
Let host A and host B be on different Ethernet networks, with router R between them. A creates an IP packet whose destination is B's IP address. On the first link its destination MAC is R's local interface, found using next-hop resolution. R receives and removes that frame, checks and processes the IP header, chooses an outgoing next hop and creates a new frame for that outgoing link. The second frame's source MAC is R's outgoing interface and destination MAC is B if B is directly attached. Source and destination IP addresses stay A and B under our no-NAT assumption; TTL decreases and IPv4 header checksum must reflect the changed header. Thus 'IP addresses unchanged' does not mean 'every IP-header bit unchanged'.
A bridge/switch ordinarily forwards by destination MAC inside a LAN; it need not terminate the transport connection. A router forwards by network-layer destination and route table. A hub/repeater regenerates signals without making either forwarding decision. Real multifunction devices can perform several roles; exam classification follows the described function.
4. Reliability is a service property
IP provides best-effort datagram delivery: loss, duplication and reordering are possible. TCP builds an ordered reliable byte-stream abstraction over IP using sequence numbers, acknowledgments and retransmissions, subject to connection failure. UDP preserves datagram boundaries but does not itself promise retransmission or in-order delivery. An application may add those features over UDP. Neither a link checksum nor a TCP checksum is encryption or proof of sender identity.
Worked counterexample: a link detects and discards a damaged frame. This prevents that particular bad frame from being delivered, but the packet is now missing; detection alone did not recover it. Recovery requires a retransmission mechanism at an appropriate layer. Layering does not imply that every layer repeats every function.
Common traps
- Use the named four-, five- or seven-layer model; don't mix counts.
- Distinguish the remote destination IP from the next-hop link address.
- Count only specified headers and identify which measurement boundary is used.
- A router usually replaces link encapsulation, not TCP endpoint identities.
- Reliable delivery does not guarantee a fixed delay, infinite availability or confidentiality.
Original practice: six single-correct MCQs
These original teaching questions are not previous-year questions. Choose exactly one answer.
P01. Which field selects TCP versus UDP inside an ordinary IPv4 packet?
A. EtherType B. Protocol C. Destination MAC D. FCS
Answer: B
A: EtherType selects the network-layer protocol.
B: The IPv4 Protocol field identifies the next protocol.
C: A MAC address identifies a link-layer recipient.
D: FCS detects frame errors.
P02. A 500-byte application payload has 20-byte TCP, 20-byte IP and 18-byte Ethernet overhead. Frame size under these assumptions?
A. 520 bytes B. 540 bytes C. 558 bytes D. 518 bytes
Answer: C
A: This counts TCP only.
B: This omits Ethernet.
C: 500+20+20+18=558 bytes.
D: This omits both TCP and IP.
P03. A sends to off-link B through router R, with no NAT. Destination IP and first-link destination MAC identify whom?
A. B and R B. R and B C. B and B D. R and R
Answer: A
A: IP names B; the first Ethernet hop is R.
B: This reverses endpoint and next hop.
C: B is not directly on the first link.
D: The IP destination is B, not R.
P04. Which is the seven-layer OSI order from bottom to top?
A. Physical, network, link, transport, session, presentation, application B. Physical, link, network, session, transport, presentation, application C. Application, presentation, session, transport, network, link, physical D. Physical, link, network, transport, session, presentation, application
Answer: D
A: Link belongs below network.
B: Transport belongs below session.
C: This is top-to-bottom.
D: This is the specified bottom-to-top order.
P05. An error-detecting receiver discards a damaged frame. What follows necessarily?
A. The sender has retransmitted B. The receiver has repaired every bad bit C. Detection alone has not recovered the discarded data D. The data is encrypted
Answer: C
A: Retransmission needs another mechanism.
B: Discard is not correction.
C: Recovery needs additional protocol behaviour.
D: Detection does not imply encryption.
P06. Which description separates a protocol from a service interface?
A. Both mean only cable signalling B. A protocol governs peers; a service interface governs local layer interaction C. A service specifies only remote packet headers D. A protocol is always an application API
Answer: B
A: Protocols exist above physical signalling.
B: Peer rules and local requests are distinct concepts.
C: The interface describes local operations, not only remote headers.
D: An API is an interface; protocols need not be APIs.
Sources and scope
Aligned to the 2026 course. This lesson covers the stated slice, not the entire Computer Networks syllabus. All numerical examples and questions are original. No claim of 2027 completeness.
Sign in to keep your progress. Sign in