Networking is complex. You have hardware (cables, WiFi), addressing (IP), reliability (TCP), and your application — all needing to work together. The layered approach solves this by giving each layer a single, well-defined job. Each layer uses the services of the layer below it and provides services to the layer above it.

Think of it like sending a letter through a courier company:

• You write the letter (Application layer)
• You put it in an envelope with an address (Transport layer adds port info)
• The courier adds a routing label (Network layer adds IP address)
• The truck physically carries it (Data link + physical medium)

Each step adds its own wrapper (header) around the data. This is encapsulation.

The TCP/IP model has four layers. From top (closest to user) to bottom (closest to hardware):

Each layer on the sender side adds its own header. Each layer on the receiver side strips the corresponding header. This is called peer-to-peer communication — logically, the TCP layer on your machine “talks” directly to the TCP layer on the remote machine, even though physically the data goes down through IP and Data Link first.

The diagram below shows how each layer on the source host communicates with the matching layer on the destination host. The arrows represent the logical (not physical) communication path.

Notice the arrows: data flows down the stack on the sender, through the network medium, and up the stack on the receiver.

When your application sends data, each layer wraps the data from the layer above inside its own structure, adding a header (and sometimes a trailer). This is called encapsulation. At the receiver, each layer strips its header and passes the inner data up. This is called de-encapsulation.

Key takeaway: by the time your 1KB application message hits the wire, it is wrapped inside a TCP header (~20 bytes), an IP header (~20 bytes), and a Data Link frame header/trailer. The receiver unwraps them in reverse order.

TCP Header (20+ bytes):

• Source port number (16 bits)
• Destination port number (16 bits)
• Sequence number — which byte in the stream this segment starts at
• Acknowledgement number — next byte expected from the other side
• Flags: SYN, ACK, FIN, RST, PSH, URG
• Checksum — integrity check of header + data
• Window size — for flow control

IP Header (20 bytes minimum):

• Source IP address (32 bits for IPv4)
• Destination IP address (32 bits for IPv4)
• Protocol field (6 = TCP, 17 = UDP)
• TTL (Time To Live) — decremented at each router; packet dropped at 0
• Header checksum (IPv4 only)
• Fragment offset (used when IP fragments a datagram)

Data Link Frame Header:

• Source MAC address
• Destination MAC address
• EtherType (0x0800 = IPv4, 0x86DD = IPv6)

This C program creates a TCP client socket and connects to a server. Even though you only call send() once with your data, the kernel automatically wraps it in a TCP header, then an IP header, then a Data Link frame — all transparently.

/* tcp_client.c - Simple TCP client demonstrating the layered model */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main(void)
{
    int sockfd;
    struct sockaddr_in server_addr;
    const char *message = "Hello from EmbeddedPathashala!";
    char buffer[256];

    /*
     * Step 1: Create a TCP socket
     * AF_INET  = IPv4 (Network layer protocol)
     * SOCK_STREAM = TCP  (Transport layer protocol)
     * The OS will handle IP + TCP headers automatically
     */
    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockfd == -1) {
        perror("socket");
        exit(EXIT_FAILURE);
    }
    printf("Socket created: fd=%d\n", sockfd);

    /* Step 2: Fill in server address (IP + Port) */
    memset(&server_addr, 0, sizeof(server_addr));
    server_addr.sin_family      = AF_INET;
    server_addr.sin_port        = htons(8080);  /* port in network byte order */
    server_addr.sin_addr.s_addr = inet_addr("127.0.0.1");

    /*
     * Step 3: connect() triggers the TCP 3-way handshake
     * SYN --> server
     * SYN+ACK <-- server
     * ACK --> server
     * Each of these goes through: TCP layer -> IP layer -> Data Link -> wire
     */
    if (connect(sockfd, (struct sockaddr *)&server_addr,
                sizeof(server_addr)) == -1) {
        perror("connect");
        close(sockfd);
        exit(EXIT_FAILURE);
    }
    printf("Connected to server\n");

    /*
     * Step 4: send() — you pass only application data.
     * Kernel wraps it:
     *   [Data Link Header][IP Header][TCP Header][Your Message]
     * That whole bundle goes onto the wire.
     */
    ssize_t sent = send(sockfd, message, strlen(message), 0);
    printf("Sent %zd bytes of application data\n", sent);
    printf("(Actual bytes on wire = %zd + ~40 bytes of headers)\n",
           sent);

    /* Step 5: receive the reply */
    ssize_t n = recv(sockfd, buffer, sizeof(buffer) - 1, 0);
    if (n > 0) {
        buffer[n] = '\0';
        printf("Received: %s\n", buffer);
    }

    close(sockfd);
    return 0;
}

/* Compile and run:
   gcc -o tcp_client tcp_client.c
   ./tcp_client

   To see the actual IP + TCP headers on the wire, use tcpdump:
   sudo tcpdump -i lo -n port 8080 -X
   The -X flag shows hex dump including all headers.
*/

Use tcpdump or Wireshark to actually see the encapsulation. You will see the Ethernet frame, then inside it the IP header with src/dst addresses, then the TCP header with ports and sequence numbers, then your data.