Encapsulation
Definition
The process by which each OSI layer wraps the payload from the layer above it inside its own header (and sometimes trailer). A packet capture shows the result of encapsulation: the outermost frame contains all inner headers nested inside it.
- Process
- Each OSI layer wraps the payload above it
- Visible in
- Packet captures
- Result
- Nested headers inside the outer frame
Common questions
Why does encapsulation matter for network forensic analysis?+
Examining the nested headers layer by layer lets an investigator reconstruct source and destination addressing, protocol, and payload at each level from a single captured frame.
How does decapsulation differ from encapsulation?+
Decapsulation is the reverse process carried out by the receiving system, stripping each layer's header in turn to recover the original payload. A packet capture tool must parse the same nesting order to interpret the traffic.
Related terms
- DNS Query Log
- A record maintained by a DNS resolver listing each domain name query, the requesting IP address, the response, and the timestamp. DNS...
- PCAP (Packet Capture File)
- A binary file format that stores raw network traffic captured from a network interface. Tools such as Wireshark, tcpdump, and Zeek read...
- Protocol Data Unit (PDU)
- The named unit of data at each OSI layer: a frame at Layer 2, a packet at Layer 3, a segment at...
- Server Name Indication (SNI)
- A TLS extension sent in plaintext in the Client Hello message that identifies the hostname the client intends to reach. SNI is...
- TCP Three-Way Handshake
- The connection establishment sequence in TCP: the client sends SYN, the server responds SYN-ACK, and the client completes with ACK. The timestamps...