5.2 TCP/IP Model & Encapsulation

The TCP/IP model (also called the DoD model or Internet protocol suite model) describes how the real Internet stacks protocols. Where OSI is a seven-layer teaching framework, TCP/IP is closer to what hosts and routers actually implement. For the Cyber Test, you must map TCP/IP ↔ OSI, explain encapsulation, and reason about what each header is for.

---

Four-Layer TCP/IP Model

Different textbooks rename the bottom layer, but the four-layer picture is standard for aptitude exams:

Some materials split Link into separate Network Interface and Hardware layers; the exam-relevant idea is the same: IP sits above the local link technology.

---

TCP/IP vs OSI — Side-by-Side Mapping

Why collapse 5–7? Internet engineering historically treated formatting, sessions, and apps as host software concerns above TCP/UDP sockets. TLS is a good example: conceptually Presentation/Application in OSI talk, but operationally it is a library sitting above Transport in the TCP/IP worldview.

Exam scenario: “Which TCP/IP layer corresponds to OSI Network?” → Internet. “Which OSI layers map to TCP/IP Application?” → 5, 6, and 7.

---

Encapsulation: Building the Packet

Encapsulation is the process of wrapping higher-layer data with lower-layer headers (and sometimes trailers) as data moves down the stack on the sending host.

Walkthrough — browser GET to https://example.mil:

1. Application creates an HTTP request (data).
2. TLS (often discussed with Application/Presentation) may encrypt that data.
3. Transport adds a TCP header (source/dest ports, sequence numbers, flags) → segment.
4. Internet adds an IP header (source/dest IP, TTL, protocol = TCP) → packet.
5. Link adds an Ethernet header (src/dest MAC, EtherType) and FCS trailer → frame, then Physical sends bits.

Mnemonic: as data goes down, headers are added; as data goes up on the receiver, headers are removed (de-encapsulation).

Visual Order (Outside → Inside on the Wire)

[Ethernet HDR][IP HDR][TCP HDR][HTTP data][FCS]

Security tools inspect different shells: switches care about Ethernet; routers about IP; host firewalls about TCP ports; WAFs about HTTP.

---

De-encapsulation on the Receiver

The destination host reverses the process:

1. NIC receives bits → reconstructs frame; checks FCS.
2. If dest MAC matches (or promiscuous mode), strip Ethernet header; pass payload up.
3. IP layer verifies checksum/TTL concepts, confirms dest IP is local, strips IP header.
4. Transport demuxes by destination port to the correct socket.
5. Application receives the byte stream / datagram and parses HTTP.

If any check fails (wrong MAC, expired TTL at a router, closed port, bad TLS), delivery stops at that layer — another reason layered models matter for cyber troubleshooting.

---

What Happens at Each Router Hop?

Encapsulation is not “set once and forget.” At each hop:

• The IP packet (Internet layer) is the unit routers forward.
• Routers de-encapsulate the Layer-2 frame, make a Layer-3 decision, then re-encapsulate into a new Layer-2 frame for the next link (new MACs, possibly different media: Ethernet → serial → Ethernet).
• IP addresses generally stay the same end-to-end (except NAT), while MAC addresses change every hop.

Exam trap: “Do MAC addresses stay constant across the Internet path?” → No. “Do IP addresses normally identify the end hosts across hops?” → Yes (without NAT).

---

Ports, Sockets, and Multiplexing

Transport encapsulation includes port numbers so one IP host can run many services:

• Destination port 443 → typically HTTPS server socket.
• Ephemeral source ports identify client conversations.

A socket is roughly {protocol, local IP, local port, remote IP, remote port} for TCP. Multiplexing/demultiplexing is why two browser tabs can talk to the same server simultaneously.

---

Connection-Oriented vs Connectionless (Encapsulation Implications)

• TCP encapsulation supports handshake (SYN/SYN-ACK/ACK), sequencing, and ACKs — more header fields, more reliability.
• UDP encapsulation is smaller — length and checksum — favoring DNS queries, VoIP, and low-overhead telemetry.

Choosing TCP vs UDP is a Transport decision that still rides inside the same IP/Ethernet shells.

---

Cyber-Relevant Capture Scenario

Analysts see a PCAP:

• Ethernet: aa:bb:... → cc:dd:..., EtherType 0x0800 (IPv4).
• IP: 10.1.1.5 → 8.8.8.8, protocol TCP.
• TCP: sport 53122 → dport 443, flags ACK/PSH.
• Payload: TLS records.

Interpretation: Link frames a local hop; Internet targets a public resolver/path; Transport aims at HTTPS; Application data is encrypted. Blocking at wrong layer wastes time — e.g., chasing HTTP content when you only have TLS ciphertext.

---

Quick Comparison Card

Master mapping + the hop-by-hop MAC rewrite story. Those two ideas unlock most Cyber Test questions on models and encapsulation without requiring vendor CLI trivia.