OSI Model vs. TCP/IP Suite: Packet Encapsulation & De-Encapsulation Guide for CCNA

Why do network engineers talk about "Layer 2 switches" and "Layer 3 routers," and what actually changes inside a packet header as it crosses a router boundary? This guide explains the OSI and TCP/IP networking models with hands-on packet inspection.

---

Every network communication—from loading a web page over HTTPS to running an ICMP ping test—relies on a layered architecture. Rather than designing a single monolithic protocol that handles copper voltage levels, hardware MAC addressing, global IP routing, and application data formatting all at once, networking standards divide these responsibilities into independent layers.

Two reference models appear on the Cisco CCNA (200-301) exam and in daily network troubleshooting:

1. The OSI (Open Systems Interconnection) Reference Model: Standardized by the International Organization for Standardization in ISO/IEC 7498-1, consisting of 7 layers.
2. The TCP/IP Protocol Suite: Standardized by the Internet Engineering Task Force (IETF RFC 1122 and related RFCs) and commonly taught in modern CCNA curricula as a 5-layer (or 4-layer RFC 1122) operational model.

You can observe Layer 2 frame forwarding and Layer 3 packet routing live in your browser using the Web Packet Tracer & Network Simulator.

---

1. Comparing the 7-Layer OSI Model and the TCP/IP Model

While the TCP/IP suite represents the actual protocols running on the modern internet, network engineers universally use OSI layer numbers (Layer 1 through Layer 7) to classify hardware devices and isolate network faults.

OSI Layer #	OSI Layer Name	TCP/IP (5-Layer Curriculum)	TCP/IP (RFC 1122 4-Layer)	PDU (Protocol Data Unit)	Core Addressing / Identifiers	Example Protocols & Standards
Layer 7	Application	Application	Application	Data / Payload	URLs, Hostnames	HTTP/HTTPS, DNS, DHCP, SSH
Layer 6	Presentation	Application	Application	Data / Payload	Character / Media Encoding (UTF-8, TLS)	TLS/SSL, JPEG, ASCII, JSON
Layer 5	Session	Application	Application	Data / Payload	Session IDs	NetBIOS, RPC, TLS Session
Layer 4	Transport	Transport	Transport	Segment (TCP) / Datagram (UDP)	16-bit TCP/UDP Port Numbers (0–65535)	TCP (RFC 9293), UDP (RFC 768)
Layer 3	Network	Network (Internet)	Internet	Packet	32-bit IPv4 / 128-bit IPv6 Logical Addresses	IPv4 (RFC 791), IPv6 (RFC 8200), ICMP (RFC 792)
Layer 2	Data Link	Data Link	Link (Network Interface)	Frame	48-bit MAC Physical Addresses (XX:XX:XX:XX:XX:XX)	IEEE 802.3 Ethernet, IEEE 802.11 Wi-Fi, ARP
Layer 1	Physical	Physical	Link (Network Interface)	Bits (0 and 1)	Physical Ports & Cabling	100BASE-TX, 1000BASE-T, Fiber Optics

---

2. What Each Layer Actually Does

Layers 5, 6, and 7: The Upper (Application) Layers

In the TCP/IP suite, OSI Layers 5, 6, and 7 are combined into the Application Layer:

• Application (Layer 7): Provides network services to user software (such as a web browser or email client) via protocols like HTTP, DNS, and DHCP. It does not mean the user application itself (e.g., Chrome or Firefox), but rather the application-layer protocol it speaks.
• Presentation (Layer 6): Ensures data sent by the application layer of one system can be read by the application layer of another (e.g., data serialization, compression, and encryption).
• Session (Layer 5): Manages the establishment, maintenance, and termination of communication sessions between hosts.

Layer 4: Transport Layer (Host-to-Host / Process-to-Process Delivery)

The Transport Layer multiplexes multiple application conversations over a single network connection using 16-bit source and destination port numbers (for example, TCP port 443 for HTTPS or UDP port 53 for DNS) and segments large data streams:

• TCP (Transmission Control Protocol): Connection-oriented (3-way handshake: SYN, SYN-ACK, ACK), reliable delivery with sequence numbers, acknowledgments, and windowing/flow control. Its PDU is called a Segment.
• UDP (User Datagram Protocol): Connectionless, low-overhead best-effort delivery without retransmission delays. Its PDU is called a Datagram.

Layer 3: Network Layer (End-to-End Logical Routing)

The Network Layer provides logical addressing (IPv4 and IPv6) and path determination (routing) between different networks (subnets).

• Routers operate at Layer 3.
• Unless Network Address Translation (NAT) is configured at a perimeter boundary, the Source IP and Destination IP inside an IPv4 packet header remain constant from the original sending host all the way to the final destination host—only the TTL (Time to Live) field is decremented by 1 at each router hop (along with a recalculated IPv4 header checksum).

Layer 2: Data Link Layer (Hop-by-Hop Local Delivery)

The Data Link Layer provides node-to-node (hop-by-hop) delivery across a single local area network (LAN) or point-to-point link.

• Ethernet Switches and Network Interface Cards (NICs) operate at Layer 2 using 48-bit MAC (Media Access Control) addresses.
• Layer 2 encapsulates the Layer 3 IPv4 packet inside an Ethernet Frame, adding a Layer 2 header (Destination MAC, Source MAC, EtherType) and a Layer 2 Trailer containing a 32-bit FCS (Frame Check Sequence) using a Cyclic Redundancy Check (CRC) to detect bit errors in transit.
• Crucially, Layer 2 MAC addresses never cross a router. Every time a router forwards an IPv4 packet out a new interface, it strips off the old Layer 2 Ethernet header/trailer and encapsulates the packet in a brand-new Ethernet frame with the egress interface's Source MAC and the next-hop device's Destination MAC.

Layer 1: Physical Layer (Signaling on the Wire)

The Physical Layer converts the binary bits of the Layer 2 frame into electrical voltages on twisted-pair copper cables (Cat5e/Cat6), pulses of light on fiber-optic strands, or radio frequency (RF) electromagnetic waves. It defines cable pinouts, maximum cable distances (such as 100 meters for 1000BASE-T Ethernet), data rates, and physical connectors (RJ-45, SFP).

---

3. Encapsulation & De-Encapsulation Walkthrough

When PC1 (192.168.1.10) sends data to PC2 (10.0.0.10) across router R1:

Sending Host (Encapsulation - Top Down)
  [Application Data]
        │
        ▼ + L4 Header (Src Port, Dst Port)
  [ L4 Header | Data ]                       ──► Segment
        │
        ▼ + L3 Header (Src IP, Dst IP, TTL)
  [ L3 Header | L4 Header | Data ]           ──► Packet
        │
        ▼ + L2 Header (Dst MAC, Src MAC, Type) + L2 FCS Trailer
  [ L2 Hdr | L3 Hdr | L4 Hdr | Data | FCS ]  ──► Frame
        │
        ▼ Convert to electrical/optical signals
  0101101001110010...                        ──► Bits on Wire

Hands-On Lab: Observing Layer 2 vs. Layer 3 in Web Packet Tracer

1. Open the Web Packet Tracer & Network Simulator and click Load Sample Topology.
2. Notice the topology: PC1 (192.168.1.10/24) $\rightarrow$ SW1 $\rightarrow$ R1 (Gi0/0: 192.168.1.1, Gi0/1: 10.0.0.1) $\rightarrow$ SW2 $\rightarrow$ PC2 (10.0.0.10/24).
3. Switch the simulator from Realtime to Step Mode and click Ping Demo (PC1 → 10.0.0.10).
4. Click Step Forward one event at a time while watching the Packet Trace Event Log:
   • At SW1 (Layer 2 Switch): SW1 only inspects the Layer 2 Ethernet header (srcMac and dstMac). It records PC1's srcMac on Fa0/1 in its MAC address table (show mac address-table) and forwards the frame unmodified to R1 (Gi0/0). It never inspects or modifies the Layer 3 IPv4 header or TTL.
   • At R1 (Layer 3 Router): R1 receives the frame on Gi0/0, verifies that the Destination MAC matches Gi0/0's MAC address, de-encapsulates (strips) the Layer 2 Ethernet frame, and inspects the Layer 3 IPv4 packet (dst: 10.0.0.10).
   • R1 decrements ttl from 128 to 127, looks up 10.0.0.10 in its routing table (show ip route), selects exit interface Gi0/1, and re-encapsulates the packet into a new Layer 2 Ethernet frame with srcMac = R1 Gi0/1 MAC and dstMac = PC2 eth0 MAC.

---

4. Legitimate Sources & Standards References

• ISO/IEC 7498-1:1994: Information technology — Open Systems Interconnection — Basic Reference Model: The Basic Model (International Organization for Standardization).
• IETF RFC 1122: Requirements for Internet Hosts — Communication Layers (R. Braden, Ed., October 1989).
• IETF RFC 791: Internet Protocol — DARPA Internet Program Protocol Specification (J. Postel, September 1981).
• IEEE Std 802.3: IEEE Standard for Ethernet (IEEE Computer Society).
• Cisco CCNA 200-301 Exam Topics (v1.1): Domain 1.0 Network Fundamentals (1.1 Explain the role and function of network components; 1.5 Compare TCP to UDP).

---

5. CCNA 200-301 Exam Prep: Questions & Detailed Answers

Question 1

Which Protocol Data Unit (PDU) name refers specifically to data encapsulated at Layer 2 of the OSI model, and which field is appended in a Layer 2 trailer for error detection?

• A. Packet; Time to Live (TTL)
• B. Segment; TCP Checksum
• C. Frame; Frame Check Sequence (FCS)
• D. Frame; Flow Label

Correct Answer: C
Explanation: At Layer 2 (Data Link Layer), the Protocol Data Unit is called a Frame. Data Link protocols such as Ethernet are unique in the OSI stack because they add both a Layer 2 Header (containing Destination MAC, Source MAC, and EtherType/Length) and a Layer 2 Trailer containing the 32-bit Frame Check Sequence (FCS). The receiving NIC runs the same CRC algorithm over the frame and compares the result to the FCS; if they do not match, the corrupted frame is discarded. Option A describes Layer 3 (Packet / TTL), and Option B describes Layer 4 (Segment).

---

Question 2

Host A (192.168.1.10) sends an ICMP Echo Request to Host B (10.0.0.10) across one router (R1) and two Layer 2 switches (SW1 and SW2). As the frame exits R1 toward SW2, what are the Source MAC address and Source IPv4 address in the frame?

• A. Source MAC = Host A's MAC; Source IP = 192.168.1.10
• B. Source MAC = R1's egress interface (Gi0/1) MAC; Source IP = 192.168.1.10
• C. Source MAC = R1's egress interface (Gi0/1) MAC; Source IP = 10.0.0.1
• D. Source MAC = SW2's ingress interface MAC; Source IP = 192.168.1.10

Correct Answer: B
Explanation: Layer 3 IP addresses are end-to-end (assuming no NAT), so the Source IP remains Host A's IP (192.168.1.10) and the Destination IP remains Host B's IP (10.0.0.10) across the entire path. However, Layer 2 Ethernet MAC headers are hop-by-hop between Layer 3 devices. When R1 routes the packet out of Gi0/1, it builds a new Ethernet frame with R1's Gi0/1 MAC address as the Source MAC and Host B's MAC address as the Destination MAC. Layer 2 switches (SW1 and SW2) do not rewrite MAC addresses when forwarding unicast frames.

---

Question 3

Which two layers of the 7-layer OSI model are combined into the Application Layer of the TCP/IP model alongside Layer 7?

• A. Session (Layer 5) and Presentation (Layer 6)
• B. Transport (Layer 4) and Session (Layer 5)
• C. Data Link (Layer 2) and Physical (Layer 1)
• D. Network (Layer 3) and Transport (Layer 4)

Correct Answer: A
Explanation: In the TCP/IP suite (RFC 1122 and the 5-layer CCNA curriculum model), the functions of the OSI Session Layer (Layer 5) and Presentation Layer (Layer 6) are handled within the Application Layer alongside Layer 7 protocols.

---

Question 4

When a Layer 2 Ethernet switch (SW1) receives an Ethernet frame from a PC and forwards it to a router, up to which OSI layer does the switch inspect the traffic to make its forwarding decision?

• A. Layer 1 (Physical)
• B. Layer 2 (Data Link)
• C. Layer 3 (Network)
• D. Layer 4 (Transport)

Correct Answer: B
Explanation: A standard Layer 2 switch inspects the Layer 2 Ethernet header—specifically the Source MAC address (to populate its MAC address table) and the Destination MAC address (to look up the egress port in its MAC address table). It does not decapsulate or inspect the Layer 3 IPv4 packet header to forward normal Ethernet traffic.

---

Question 5

Which field inside the Layer 2 Ethernet II header identifies the Layer 3 protocol encapsulated inside the frame's payload (for example, 0x0800 for IPv4, 0x0806 for ARP, or 0x86DD for IPv6)?

• A. Protocol field
• B. Port number
• C. EtherType field
• D. Frame Check Sequence (FCS)

Correct Answer: C
Explanation: The 2-byte EtherType field in an Ethernet II header tells the receiving device's network stack which Layer 3 protocol is carried in the payload (0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6). By contrast, the Protocol field (Option A) lives inside the Layer 3 IPv4 header to identify the Layer 4 protocol (such as 1 for ICMP, 6 for TCP, or 17 for UDP).