Chapter 2: Network Models (OSI and TCP/IP Network

Models)
A network model is a structured way of describing how data moves from one device to
another in a network. Imagine you are sending a message using a postal system. The
process follows specific rules—you must write the address, buy a stamp, and send the
letter via a postal service. Similarly, when computers communicate, they follow
network models that define how data is organized, transmitted, and received.
Importance of a Network Models:
1- Standardization – Ensures that devices from different companies (e.g., Apple,
Samsung, Dell) can communicate with each other.
2- Troubleshooting – Helps to isolate problems in networks layer by layer.
3- Scalability – Allows networks to grow without becoming too complicated.
4- Interoperability – Makes that different networks (Wi-Fi, Ethernet, Mobile) can
work together.
There are two main models in networking:
• OSI Model (7 layers) – A theoretical model that explains networking in a
structured way.
• TCP/IP Model (5 layers) – A practical model that is used in real-world
networks, including the Internet.

Advantages of Layering:
1- Modular Design – Makes networks more straightforward to build and modify.
2- Easier Troubleshooting – If something goes wrong, we can fix just one layer
instead of the whole system.
3- Interoperability – Allows different technologies to work together.

Encapsulation & decapsulation

Encapsulation and decapsulation are fundamental processes in networking that allow

data to travel efficiently across different devices and networks.

Encapsulation occurs when data moves from the sender to the network, passing
through various layers. Each layer adds its own header (and sometimes a trailer) that
contains essential information such as addressing, sequencing, and error detection.

Decapsulation happens on the receiving side, where each layer removes its
corresponding header/trailer to extract the original data and pass it to the application
for processing.

Page 1 of 17
These processes ensure that data is structured, transmitted, and interpreted
correctly at each step. Without encapsulation, devices wouldn’t know how to send,
route, or interpret data, and without decapsulation, the receiving system wouldn’t
understand the incoming information.

The concept is the same in both OSI and TCP/IP models (the difference is the number
of layers involved).

First Model : OSI Model – The 7 Layers:

OSI Model:
The Open Systems Interconnection (OSI) model is a conceptual framework
developed by the International Organization for Standardization (ISO) in the late 1970s
. It divides the complex task of network communication into 7 distinct layers, each
with a specific role. This layered approach (protocol layering) means each layer handles
a part of the communication process and provides services to the layer above it. A
protocol is a set of rules that define how data is transmitted and received; when
communication is complex, multiple protocols are organized in layers to work together

Data Movement in The OSI model:

When data is sent over a network, it passes through each layer of the model, acquiring
or losing layer-specific information in a process known as encapsulation (at the sender)
and decapsulation (at the receiver). Encapsulation is the process of adding a header (and
sometimes a trailer) to data as it moves down the layers, preparing it for transmission.
Decapsulation is the reverse – removing those headers/trailers as the data moves up the
layers at the destination.
The concept is the same in both OSI and TCP/IP models (the difference being just the
number of layers involved).

Encapsulation (at the Sender):

1. Application Layer (OSI Layer 7): The process begins with user data generated
by an application (for example, the text of an email or the content of a file being
sent).
The application layer creates the message data.
the raw data (often called the message or data). For instance, an email client
formulates the email content at the application layer.

Page 2 of 17
 2. Presentation Layer (Layer 6): The data may be translated, encrypted and
compression, at this layer if needed.
For example, if encryption is enabled (such as in secure emails or web traffic
using SSL/TLS), the presentation layer applies encryption or character encoding
conversions to the data. The data is now in a format suitable for the recipient’s
system (e.g., encoded in a standard character set and possibly encrypted for
security).

3. Session Layer (Layer 5): The session layer adds information to manage the
session. It may attach a session identifier to distinguish this session’s data from
other sessions and handle any synchronization tasks. (In many modern
protocols, this layer’s functions might be minimal or integrated with the
application layer, but conceptually, this is where session management info
would be added.

4. Transport Layer (Layer 4): The transport layer takes the data (which may now
include presentation/session info) and splits it into smaller pieces if necessary,
creating segments TCP / datagrams UDP. Each segment is given a transport
header. This header includes information like port numbers (which identify
which application process should receive the data on the destination side).

TCP (Transmission Control Protocol)

• TCP is a connection-oriented protocol that ensures reliable and ordered data

transmission by using acknowledgments and error checking.
• It is used in applications where accuracy is critical, such as web browsing, emails,
and file transfers.

UDP (User Datagram Protocol)

• UDP is a connectionless protocol that sends data quickly without guaranteeing

delivery, order, or error correction.
• It is used in real-time applications like online gaming, video streaming, and VoIP,
where speed is more important than reliability.

5. Network Layer (Layer 3): Next, each transport segment gets passed to the
network layer, which adds a network layer header, creating a packet (or IP
datagram, in the Internet). This header contains the logical source and
destination addresses (for instance, the source and destination IP addresses in
an IP packet). It is at this layer that routing decisions will be made, but during
encapsulation, the main job is to label the packet with addresses so it can be
delivered across networks. After this step, the data unit is typically called a

Page 3 of 17
 packet (or datagram). For example, the IP layer will indicate that a packet is
going from IP address 192.168.1.5 to 10.0.0.7.

6. Data Link Layer (Layer 2): The network-layer packet is then handed to the
data link layer, which encapsulates it into a frame, The data link layer adds its
own header and a trailer. The header includes physical addresses (such as
MAC addresses for Ethernet) of the next-hop devices (e.g., the MAC address of
the router your frame is being sent to). It may also include other information
like frame type. The trailer often contains an error-checking code (CRC) to
detect corruption in transit. At this point, the unit of data is a frame. For
example, an frame will have a header with the MAC address of the sender and
receiver (next-hop), and a trailer with a CRC checksum.

7. Physical Layer (Layer 1): Finally, the frame is sent to the physical layer, which
converts the frame into signals (electrical, light, or radio signals depending on
the medium) and transmits the raw bits over the physical medium. This is where
the data truly moves through the network cable or the air (in case of wireless).
The physical layer doesn’t add a header like other layers; instead, it is concerned
with the transmission of the bits that make up the frame. For example, on an
Ethernet cable, the frame’s bits are encoded into voltage pulses; on Wi-Fi, they
might be modulated into radio waves.
At this point, the data has been fully encapsulated with all the necessary headers/trailers
and is broadcasting as signals through the network. It travels through potentially
multiple networks and devices (like routers and switches).

When it arrives at the destination, the process reverses:

Decapsulation (at the Receiver):

1. Physical Layer: The receiver’s physical layer picks up the signals from the medium
and reconstructs them into a series of bits. It passes this bit stream to the data link
layer, essentially handing off what it perceives as a complete frame.

2. Data Link Layer: The data link layer on the receiver takes the raw bits and
interprets them as a frame (using the framing structure and error checking). It then
checks the frame (verifies the CRC for integrity). Assuming the frame is valid and
addressed to this device, the data link layer removes and processes the data link
header and trailer – for example, it strips off the Ethernet header/trailer, learning
the sender’s MAC and confirming the destination MAC was itself. It then passes
the remaining data (the network-layer packet) up to the network layer. (If the frame

Page 4 of 17
 was not meant for this device or if an error is detected, the frame would be dropped
at this stage.)

3. Network Layer: The network layer receives the packet. It examines the network
layer header (e.g., the IP header) to ensure the packet is indeed for this host
(destination IP matches). It then removes the network layer header, yielding the
encapsulated segment, and passes that segment up to the transport layer. If the
network layer performs routing (for intermediate routers), it would forward the
packet instead of passing up; but here we are at the destination host, so routing is
done and we proceed upward.

4. Transport Layer: The transport layer now has the segment. It looks at the port
number in the segment header to determine which application process should
receive the data (for example, port 80 -> web server process, port 25 -> email
service, etc.).

5. Session Layer: If a session layer is present conceptually, it would use the session
ID to properly route the data to the correct session and handle any session-specific
tasks (like managing dialogue, synchronization points). In practice, this might
involve ensuring that the data is in sequence in a multi-stream conversation or re-
establishing a session if it was interrupted (though these functions are often minimal
or handled in the application). The session layer then removes any session
header/info (if it existed)

6. Presentation Layer: The presentation layer will now take the data (which might
still be encrypted or encoded in a machine-specific format) and translate or
decrypt it into a form that the application can understand. For example, if the data
was encrypted, this layer would decrypt it; if it was compressed, it would
decompress it; if it was encoded in a special format, it would convert it to a usable
format. After this step, the data is restored to the original form that was given by
the sender’s application.

7. Application Layer: Finally, the application layer at the receiver gets the data in its
original, usable form. It can then pass it to the actual application software. For
instance, the email server application receives the email text, or the web browser
gets the HTML page data. This completes the decapsulation – the user/application
can now read or process the message that was sent. Throughout this journey, each
layer only deals with its own headers and content, and each layer’s header/trailer is
stripped off by the corresponding layer at the destination.

This encapsulation/decapsulation process is fundamental to how layered

communication works. It allows, for example, the transport layer to worry about

Page 5 of 17
application-to-application delivery without knowing anything about the physical
medium and the network layer to route packets without knowing what content they
carry.

Example: Sending a Chat Message in WhatsApp (OSI Model

Encapsulation Process)
Imagine you are using WhatsApp on your smartphone and you send a text message
"Hello!" to your friend. This message must go through all 7 layers of the OSI model
before reaching your friend’s phone.

Step 1: Application Layer (Layer 7 – Message Creation and Formatting)

• The WhatsApp application formats the message ("Hello!") in a way that can
be understood by the receiver’s WhatsApp.
• WhatsApp uses the XMPP (Extensible Messaging and Presence Protocol)
for instant messaging.
• The application layer ensures that the recipient’s username (WhatsApp ID)
and contact info are correctly attached to the message.

Encapsulation at this layer: The original message is created. The application layer
adds metadata, such as sender/receiver details, and formats the data for transmission.

Step 2: Presentation Layer (Layer 6 – Data Encryption and

Compression)

• WhatsApp encrypts the message using end-to-end encryption (E2EE) to

ensure security.
• Encryption ensures that only the intended recipient can read the message.
• If necessary, data compression is applied to reduce the size of the message,
making transmission faster.

Encapsulation at this layer: The message is now encrypted and possibly

compressed, ensuring security and efficiency.

Step 3: Session Layer (Layer 5 – Managing the Communication)

• The session layer establishes and maintains a session between your phone
and the WhatsApp server.
• It ensures that multiple messages exchanged between you and your friend do
not interfere with each other.
• If there is an interruption (e.g., network dropout), the session layer will
restore the session when the connection is back.

Page 6 of 17
Encapsulation at this layer: The session information is added to track the ongoing
conversation.

Step 4: Transport Layer (Layer 4 – Ensuring Reliable Delivery)

• The transport layer breaks the message into smaller segments (if needed)
and ensures it is transmitted correctly.
• WhatsApp primarily uses TCP (Transmission Control Protocol) for chat
messages, ensuring reliable delivery.
• TCP adds sequence numbers so that messages arrive in the correct order.
• It also adds error detection to request retransmission if data is lost.

Encapsulation at this layer: A TCP header is added, containing:

• Source Port (e.g., 54321) – The port number assigned by the sender’s phone.
• Destination Port (e.g., 5222 for WhatsApp XMPP messaging) – Identifies
the application receiving the message.
• Sequence number – Ensures message order.
• Error-checking information.

Now, the message is a "segment", ready for further processing.

Step 5: Network Layer (Layer 3 – Adding IP Addresses and Routing)

• The network layer assigns source and destination IP addresses to the

segment.
• Your phone’s IP address (e.g., 192.168.1.10) and the WhatsApp server’s IP
address (e.g., 172.217.16.10) are added.
• The IP header also includes Time-To-Live (TTL), ensuring packets do not
circulate indefinitely.
• The message (now a packet) is ready for routing through the Internet.

Encapsulation at this layer: The IP header is added, containing:

• Source IP (your phone’s IP)

• Destination IP (WhatsApp server’s IP)
• TTL (Time to Live) to prevent looping.

Now, the message is a "packet" and ready for transmission.

Step 6: Data Link Layer (Layer 2 – Local Network Delivery Using MAC
Addresses)

Page 7 of 17
 • The packet is encapsulated in a frame before being sent over the local
network (Wi-Fi or mobile data).
• The source MAC address (your phone’s MAC) and destination MAC
address (router’s MAC) are added.
• The frame also includes an error-checking CRC (Cyclic Redundancy
Check) trailer.

Encapsulation at this layer: A data-link frame is created, adding:

• Source MAC (your phone’s MAC address).

• Destination MAC (your router’s MAC address).
• Frame check sequence (error detection).

Now, the message is a "frame", ready to be sent over the network.

Step 7: Physical Layer (Layer 1 – Transmission Over the Network)

• The frame is converted into electrical signals (if using Ethernet), radio
waves (if using Wi-Fi), or optical pulses (if using fiber).
• These signals travel through the network toward the WhatsApp server.

Encapsulation at this layer: The frame is converted into physical signals and sent
across the network.

Now, Data Travels Through the Internet:

• The message moves through multiple networks, routers, and switches.

• Each router only reads the Network Layer (Layer 3) IP header to forward
the packet correctly.
• The frame is re-encapsulated at each hop (router) for local delivery.

Receiving the Chat Message (OSI Model Decapsulation Process)

Now that the message has reached the WhatsApp server and is being forwarded to your
friend’s phone, the decapsulation process occurs in reverse order:

1. Physical Layer (Layer 1):

o The receiving device (your friend’s phone) receives the signals and
converts them back into bits.
2. Data-Link Layer (Layer 2):
o The frame’s destination MAC address is checked.
o The data-link header/trailer is removed, leaving the IP packet.
3. Network Layer (Layer 3):

Page 8 of 17
 o The destination IP address is checked.
o The IP header is removed, leaving the TCP segment.
4. Transport Layer (Layer 4):
o The TCP header is removed.
o If multiple segments exist, TCP reassembles them in order.
o The extracted data is sent to the session layer.
5. Session Layer (Layer 5):
o The session information is verified to ensure message continuity.
o The message is passed to the presentation layer.
6. Presentation Layer (Layer 6):
o The message is decrypted using WhatsApp’s end-to-end encryption.
o Any necessary formatting or decoding occurs.
o The decrypted plain text message ("Hello!") is passed to the
application layer.
7. Application Layer (Layer 7):
o The WhatsApp app receives the message and displays "Hello!" to
your friend.

Page 9 of 17
IP address, port number, and MAC address:

The IP address, port number, and MAC address are essential components of
network communication, but they serve different purposes.

1. IP Address (Internet Protocol Address)

• A unique identifier assigned to a device on a network, allowing it to

communicate over the internet or a local network.
• Function: Specifies the location of a device in a network so data can be sent
and received.
• Types:
o IPv4 (e.g., 192.168.1.1): A 32-bit address format (supports ~4.3
billion addresses).
o IPv6 (e.g., 2001:db8::ff00:42:8329): A 128-bit address format
(supports a much larger address space).

• IP addresses are further subdivided into dynamic and static IPs:

o Dynamic IP addresses change at set time intervals and are usually assigned
by the ISP to a device when it connects to the internet.
o Static IP addresses remain the same over an extended period and are often
used for services that require a consistent address, such as hosting a
website or running a mail server

• It operates at the Network Layer (Layer 3) of the OSI model.

• They reassigned dynamically (assigned by a DHCP server) or static (manually
assigned).

2. Port Number

• A logical endpoint in network communication that helps distinguish different

services running on the same device.
• Identifies a specific process or service within a device for communication.
• Example TCP:
o HTTP (Web Traffic) → Port 80
o HTTPS (Secure Web Traffic) → Port 443
o FTP (File Transfer Protocol) → Port 21
o WhatsApp Messaging & Calls → Port (5222, 5223)

• Example UDP:
o WhatsApp Voice & Video Calls→ Port (3478, 3479, 3480-349)
o WhatsApp Peer-to-Peer Calls→ Port (49152-65535)

Page 10 of 17
 • It Operates at the Transport Layer (Layer 4) of the OSI model.
• ports are assigned dynamically or manually depending on the service.

3. MAC Address (Media Access Control Address)

• A physical, unique hardware address assigned to a network interface card

(NIC) by the manufacturer.
• It helps devices communicate within a local network (LAN) by ensuring data
is sent to the correct hardware device.
• It contains a 48-bit hexadecimal number (e.g., 00:1A:2B:3C:4D:5E).
• It Operates at the Data Link Layer (Layer 2) of the OSI model.
• It is hardcoded in hardware, but some systems allow MAC address spoofing.

The connection between the devices can be through: Hub, Router, and
Switch:
1. Hub
- A hub is a basic networking device that connects multiple computers in a local
network and transmits data to all connected devices.
- When a device sends data, the hub broadcasts it to all connected devices,
regardless of the intended recipient.
- Layer: Operates at Layer 1 (Physical Layer) of the OSI model.
- Addressing Used: No addressing – it does not use MAC or IP addresses.
- Data Transmission Type: Broadcast (sends data to all devices).
- Used in small, simple networks (mostly outdated, replaced by switches).

Example: If a computer sends a file, all connected devices receive it, but only the
intended recipient processes it.

Hub may Cause network congestion because all devices receive all data. Not
efficient.

2. Switch
- A switch is a networking device that connects multiple devices in a local
network (LAN) and forwards data only to the intended recipient.
- It learns the MAC addresses of connected devices and sends data directly to
the correct destination.
- Operates at Layer 2 (Data Link Layer) of the OSI model.
- Addressing Used: Uses MAC (Physical) addresses to forward data.
- Data Transmission Type: Unicast, Multicast, or Broadcast (sends data only to
the intended recipient).
- Used in LANs for efficient communication (modern alternative to hubs).

Page 11 of 17
 Example: If a computer sends a file, the switch forwards it only to the recipient
instead of all devices.

Switch Reduces congestion by sending data only to intended devices, improving

performance.

3. Router
- A router is a device that connects multiple networks and forwards data
between them based on IP addresses.
- Directs data from one network to another using the best possible route.
- Layer: Operates at Layer 3 (Network Layer) of the OSI model.
- Addressing Used: Uses IP (Logical) addresses to determine the best path for
data.
- Data Transmission Type: Unicast or Multicast (routes data based on network
destinations).
- Usage: Used in WANs (Internet) and LANs to connect different networks.
Example: When you browse a website, your router directs your request to the
internet and sends the response back to your device.

Router: Enables communication between different networks, allowing internet access

and efficient data routing.

Page 12 of 17
 Second Model : TCP/IP model – The 5 Layers:

Networking follows a layered approach to simplify data transmission. Each layer has a
specific role, and data must go through all layers when sent and received. The following
steps outline how encapsulation and decapsulation work in a 5-layer TCP/IP model
(Application, Transport, Network, Data Link, and Physical layers).

Encapsulation (Sender Side)

Encapsulation occurs as data moves down the layers before transmission:

1. Application Layer:
o The process starts with application data—for example, an email, a web
request, or a video stream.
o The application layer prepares the data for transmission but does not add a
network header.
o This raw data is then passed to the transport layer.
2. Transport Layer:
o The transport layer segments the data into smaller units and adds a
transport header containing:
▪ Source and destination port numbers (to identify sending and
receiving applications).
▪ Sequence numbers (for proper ordering).
▪ Error-checking mechanisms (like checksums).
o The resulting unit is called a segment (for TCP) or datagram (for UDP).

3. Network Layer:
o The transport segment is encapsulated into a network-layer packet (or
datagram) by adding:
▪ Source and destination IP addresses (to ensure proper delivery
across networks).
▪ Other necessary network-layer control information.
o The result is an IP packet, which is ready to be routed across different
networks.
4. Data-Link Layer:
o The IP packet is encapsulated into a data-link frame, which consists of:
▪ A MAC (Media Access Control) header with source and
destination MAC addresses (for local delivery within a network).
▪ A trailer (often containing an error-checking value, such as a CRC
checksum).
o This frame is passed to the physical layer for transmission.

Page 13 of 17
5. Physical Layer:
o The frame is converted into electrical, optical, or radio signals depending
on the transmission medium (Ethernet cables, fiber optics, or wireless
signals).
o These signals are sent out onto the network toward the destination device.

At this stage, encapsulation is complete, and the data is now traveling across the
network.

Decapsulation (Receiver Side)

When the data arrives at the destination, the process is reversed, with each layer
stripping away its corresponding headers and passing the remaining data to the layer
above:

1. Physical Layer:
o The receiving device captures the signals and converts them back into
bits, reassembling the original frame.
o The reconstructed frame is passed to the data-link layer.
2. Data-Link Layer:
o The data-link layer verifies the integrity of the frame using the trailer
(e.g., CRC checksum).
o It removes the MAC header and trailer and extracts the network-
layer packet (IP packet).
o The extracted IP packet is sent to the network layer.
3. Network Layer:
o The network layer checks the destination IP address to ensure the
packet has reached its intended destination.
o The IP header is removed, and the remaining transport-layer segment
is passed to the transport layer.
4. Transport Layer:
o The transport layer checks the port number to determine which
application should receive the data.
o If TCP is used, it reorders any out-of-sequence segments and verifies
data integrity.
o The transport header is removed, and the original application data is
passed to the application layer.
5. Application Layer:
o The application layer receives the original message, making it readable
for the user (e.g., displaying a webpage, opening an email, or playing a
video).

At this stage, decapsulation is complete, and the data is successfully delivered in its
original form.

Page 14 of 17
Example 1: Sending an Email (SMTP over TCP/IP)

When sending an email, the message undergoes encapsulation at the sender’s device
and decapsulation at the email server.

Encapsulation (Sender Side)

1. Application Layer (SMTP Protocol): The email client formats the message
using SMTP and sends it for transmission.
2. Transport Layer (TCP Protocol): TCP segments the email and assigns a
source port (random) and destination port 25 (for SMTP).
3. Network Layer (IP Protocol): The segment is placed in an IP packet with:
o Source IP: The sender’s device.
o Destination IP: The email server.
4. Data-Link Layer: The IP packet is placed in a frame with:
o Source MAC: The sender’s MAC address.
o Destination MAC: The next router’s MAC address.
5. Physical Layer: The frame is converted into electrical signals and sent through
the network.

Decapsulation (Receiver Side)

1. Physical Layer: The email server receives the signals and reconstructs the
frame.
2. Data-Link Layer: The frame header is removed, extracting the IP packet.
3. Network Layer: The IP header is removed, retrieving the TCP segment.
4. Transport Layer: The TCP header is removed, reconstructing the original
email message.
5. Application Layer (SMTP Server): The email is stored or forwarded, making
it accessible to the recipient.

Example 2: Loading a Webpage (HTTP over TCP/IP)

When you type a website URL into your browser, an HTTP request is sent to the web
server, and a response is received.

Encapsulation (Sender Side – Browser Request)

1. Application Layer (HTTP Protocol): The browser sends an HTTP GET

request for a webpage.
2. Transport Layer (TCP Protocol): TCP assigns a random source port and
destination port 80 (for HTTP).
3. Network Layer (IP Protocol): The request is put in an IP packet with:
Page 15 of 17
 o Source IP: Your device’s IP address.
o Destination IP: The web server’s IP address.
4. Data-Link Layer: The IP packet is framed and transmitted to the device.
5. Physical Layer: The request travels as signals through the network.

Decapsulation (Receiver Side – Web Server)

1. Physical Layer: The web server receives the signals and reconstructs the frame.
2. Data-Link Layer: The MAC addresses are checked, and the IP packet is
extracted.
3. Network Layer: The server confirms the destination IP and extracts the TCP
segment.
4. Transport Layer: TCP removes its header, passing the HTTP request to the
web server.
5. Application Layer (HTTP Server): The server processes the request and
prepares a webpage response, repeating the encapsulation process in reverse.

When the response reaches the browser, it goes through decapsulation, allowing the
webpage to load.

Page 16 of 17
Page 17 of 17