How Two Devices Actually Communicate

When an application has something to send, the data does not go straight onto the cable. It passes down through a series of layers, and each layer attaches its own header — a small block of information meant for the matching layer on the receiving device. Adding those headers on the way down is called encapsulation. The receiver strips them off on the way up, in reverse order, which is decapsulation.

Nothing mysterious happens at any layer. Each one simply writes down what its counterpart at the other end will need to know: which process this belongs to, which host it is for, which device should pick it up next.

Each row below is the row above it, plus one new header. The name of the unit changes as it goes — that name is the PDU you met in Lesson 1.

Read the last column carefully, because it contains the whole lesson. The IP addresses are written once and describe the two ends of the conversation. The MAC addresses describe only the current step of the journey, and they get replaced at every step.

Before a device can send anything, it has to answer one question: is the destination on my own network, or somewhere else? Everything that follows depends on that answer.

Suppose PC-A wants to reach PC-C, and the comparison says they are on the same network. PC-A can deliver the frame itself, but it needs PC-C's MAC address to address that frame:

1. PC-A compares the network portions and sees that PC-C is local.
2. PC-A looks in its ARP cache — a small table of the IP-to-MAC mappings it has already learned — for PC-C's entry.
3. If the entry is missing, PC-A uses ARP (Address Resolution Protocol) to ask the whole local network “who has this IP address?” The owner answers directly with its MAC address. Lesson 4 covers exactly what those two messages look like.
4. PC-A builds a frame addressed to PC-C's MAC, containing a packet addressed to PC-C's IP, and sends it.
5. The switch forwards the frame to the port where PC-C lives. PC-C replies, running the same process in reverse.

Now suppose the mask comparison says the destination is somewhere else. PC-A has no way to reach it directly — it only knows how to talk to devices on its own network. So it hands the traffic to the one device whose job is to forward things onward: its default gateway.

1. PC-A compares the network portions and sees the destination is not local.
2. PC-A resolves the MAC address of its default gateway — not the MAC of the faraway destination, which it could never reach anyway.
3. PC-A sends a frame addressed to the gateway's MAC. Inside that frame, the packet is still addressed to the final destination's IP.
4. The router receives the frame, discards the frame header, and reads the packet's destination IP.
5. The router consults its routing table to decide where to send it next, wraps the packet in a brand-new frame for the next link, and forwards it. The new frame's source MAC is the router's outgoing interface; the destination MAC is the next device along the path.
6. Every router along the way repeats step 5 until the packet reaches a router directly attached to the destination's network, which delivers it to the destination itself.

Put the two journeys side by side and one rule falls out of them:

Once that rule is solid, a large share of early routing questions answer themselves. If a question asks what a packet looks like after three router hops, the IP addresses are whatever the sender put there; the MAC addresses belong to the two devices on either end of the third link.

The seven OSI layers are worth learning, but not as a memory exercise. Their value is diagnostic: when something is broken, the layers give you an order to check things in, so you are not guessing. Real networks are usually described with the four-layer TCP/IP model instead, and CCNA questions use both, so learn the mapping between them.

Worked example. A user reports that a web page will not load. Rather than guessing, walk up the stack. Is the interface up and the cable connected? That is Layer 1, and it is where most real faults live. Is the device on the right VLAN and able to reach its neighbours? Layer 2. Can it reach its default gateway and get a reply from an address on another network? Layer 3 — and this is the step where a wrong mask or a missing gateway shows up. Is the connection to the server's port getting through, or is something blocking it? Layer 4. Does the name resolve to the right address? Layer 7. Five checks, in order, each with a definite answer — that habit is the backbone of every troubleshooting lesson later in this course.

• Encapsulation adds one header per layer on the way down; decapsulation removes them on the way up.
• PDU order: data → segment or datagram → packet → frame → bits.
• Every send begins with a mask comparison: same network, or not?
• Same network: resolve the destination's MAC. Different network: resolve the default gateway's MAC.
• Layer 3 IP addresses are preserved end to end; Layer 2 MAC addresses are rewritten at every hop.
• Use the layers as a checking order when something breaks — start at Layer 1.