Encapsulation and decapsulation basics for OSI layer

Question

I have read that encapsulation takes place down the layers while decapsulation takes place up the layers. In essence, the encapsulation starts at Application layer all the way upto Physical layer. Assume we have a sender A and receiver B.Sender A wants to http to a server B. So for the encapsulation down the layers on A side we would have,

Application(http)-Presentation-Session-Transport(TCP port 80)-Network(IP address of A)-Data link(Mac)-Physical(Bits 0 and 1).

From above, we can say that PDU(Protocol data unit) of upper layer(say Network Layer) becomes the data of the lower layer(say Data link layer).

Essentially,(Data+control Info )of Network layer =( Data ) of data link layer

Now coming to the receiver side B(decapsulation process) Step 1: The Physical layer header is stripped off

Step 2: The data link layer header is stripped off

Step 3: The network layer header is stripped off and so on

Q1: is the above understanding correct?

Q2: I am getting confused as to why data link layer info is stripped off first? I mean, when we do ARP, we first look at IP address(layer 3) and request for mac address(layer 2 info).

I understand that there is a value called Ethertype, that tells what upper layer protocol is being used(e.g mpls or IPv4 or IPv6) ?

Answer 1

You seem to have the general idea.

First, there really is no Physical Layer header. The Physical Layer simply takes what the Data-Link Layer gives it, and it encodes the Data-Link frame (encoding) for the interface and places that on the "wire" (signalling), or it performs the opposite when receiving data.

When layer-3 sends a packet to layer-2, layer-2 needs to encapsulate that with a layer-2 header. Part of the layer-2 header may include a MAC address for layer-2 protocols that use MAC addresses (not all do, and of those that do, some use 48-bit MAC addresses, and some use 64-bit MAC addresses).

In order to put a destination MAC address in the layer-2 frame, the destination layer-3 address must be resolved to a layer-2 address. Layer-2 needs the destination layer-2 MAC address in order to build the layer-2 frame to encapsulate the layer-3 packet. That is where ARP (Address Resolution Protocol) comes in.

ARP has to do with data leaving the host, not coming into the host where the headers are stripped. Depending on the network stack implementation, as a layer-2 frame come into a host, the MAC address may get saved in the host's ARP cache as the frame is stripped from the packet. Layer-2 will inspect the layer-2 frame to determine to which layer-3 protocol in the network stack the frame payload (layer-3 packet) should be sent.

The Ethertype field is a field in ethernet frame headers. Other layer-2 protocols have other ways of doing this. Remember, ethernet may be the most used layer-2 protocol, but it is not the only layer-2 protocol, and each have their own frame headers. Layer-3 protocols can have the the same type of thing. For instance, IPv4 has the Protocol field, and IPv6 has the Next Header field, to tell layer-3 to which layer-4 protocol the payload of the layer-3 packet should be sent.

Answer 2

While your understanding of the encapsulation is correct, the encapsulations are not actually "stripped" step by step the way you described or see in some diagrams.

When a network card receives a packet it stores it in a buffer somewhere in the computer's memory. From this point onward most systems will try to minimize any copying of the data for reasons of both efficiency and convenience.

Most applications* leave all the processing of the lower layers of a packet to the OS, so much of the processing will be done by routines working directly on that buffer, with access to all of the data, ignoring the parts they don't need. So the routines that are checking, e.g., the destination IP address of a packet will have access to the link-level headers but just ignore them. In some cases particular routines may look at more than one layer to extract the information they need, e.g., the routine that determines to which application TCP or UDP data should be sent will have to look at both the IP layer for the destination IP address and the TCP/UDP layer for the destination port because the IP address and port together form the full address that will identify the listening application.

Once the OS has done enough processing on the packet to know what kind it is and where the data goes, it will then usually copy the relevant portions of the data to another buffer to be passed up to the application.

_ _
* Programs such as tcpdump are a notable exception.