Encapsulation
“Describe what happens to an HTTP request as it goes down the stack on the sender and up on the receiver. What does each layer add and why?”
What this tests
- A concrete picture of headers wrapping payloads
- Which addresses live in which header and which ones change in flight
- Understanding that each layer’s header solves that layer’s problem
Answers by level
Read the beginner answer first and notice what is missing.
The application writes an HTTP message — text headers and a body — into a socket. TCP treats it as a byte stream, splits it into segments no larger than the MSS (typically 1460 bytes on Ethernet without options), and prefixes each with a header carrying source and destination ports (which process), a sequence number (where these bytes belong in the stream), an acknowledgement number, flags and the receive window. TCP’s header solves TCP’s problem: reliable ordered delivery between two processes.
IP wraps each segment with source and destination IP addresses, a TTL/hop limit, a protocol number (6 = TCP) and, for IPv4, a header checksum and fragmentation fields; IPv6 has a fixed 40-byte header and pushes rarely used fields into extension headers. IP’s job is getting the packet to the right host across many networks; it neither knows nor cares what is inside. The link layer (Ethernet) adds source and destination MAC addresses and a frame check sequence — its problem is getting the frame across one physical segment to the next hop.
On the wire the frame is bits. At each router the Ethernet header is stripped and a new one written with the next hop’s MAC — so MAC addresses change at every hop while the IP addresses stay constant end to end (unless NAT rewrites them). The IP TTL is decremented. On the destination host the process reverses: the NIC checks the frame, IP verifies the address and hands the payload to TCP by protocol number, TCP finds the socket by the 4-tuple and reassembles the byte stream, and the application read()s an HTTP message identical to what was written.
Green flags · Red flags
- Lists ports in TCP, IP addresses in IP, MACs in Ethernet — and why each layer needs its own
- Knows MACs change per hop while IPs stay end to end
- Mentions segmentation to the MSS and the arithmetic behind it
- Explains demultiplexing on receive: protocol number → TCP, 4-tuple → socket
- Relates header overhead to MTU/MSS problems
- Thinks MAC addresses travel end to end, or that a MAC identifies a machine globally
- Cannot say which header carries a port
- Describes layers as "adding metadata" without any specific field
- Believes IPv6 is IPv4 with longer addresses