ExamFinch.com My Study

Study guide

5.2 TCP/IP Model & Encapsulation

Practice this exam

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

5.2 TCP/IP Model & Encapsulation

Key Takeaways Explain This Topic AI

The TCP/IP (DoD) model typically uses four layers: Link/Network Access, Internet, Transport, and Application

OSI Layers 5–7 roughly collapse into TCP/IP Application; OSI 1–2 map to Link/Network Access

Encapsulation wraps data with headers (and sometimes trailers) as it descends the stack; de-encapsulation peels them on the way up

At each hop, routers strip/rebuild Layer-2 framing while preserving the IP packet for forwarding decisions

Knowing header ownership (Ethernet, IP, TCP/UDP, HTTP) helps locate where captures and firewalls inspect traffic

Last updated: July 2026

The TCP/IP model (also called the DoD model or Internet protocol suite model) describes how the real Internet stacks protocols. Where OSI is a seven-layer teaching framework, TCP/IP is closer to what hosts and routers actually implement. For the Cyber Test, you must map TCP/IP ↔ OSI, explain encapsulation , and reason about what each header is for.

Four-Layer TCP/IP Model

Different textbooks rename the bottom layer, but the four-layer picture is standard for aptitude exams:

TCP/IP layer Rough OSI mapping Role Example protocols

Application OSI 5–7 (Session, Presentation, Application) User services and app protocols HTTP, DNS, FTP, SMTP, SSH

  • Transport OSI 4 Process-to-process delivery TCP, UDP
  • Internet OSI 3 Logical addressing & routing IP, ICMP, IGMP, routing protocols’ IP carriage
  • Link / Network Access OSI 1–2 Framing + physical transmission Ethernet, Wi-Fi, PPP, ARP (often taught here)

Some materials split Link into separate Network Interface and Hardware layers; the exam-relevant idea is the same: IP sits above the local link technology .

TCP/IP vs OSI — Side-by-Side Mapping

  • OSI TCP/IP
  • 7 Application Application
  • 6 Presentation Application
  • 5 Session Application
  • 4 Transport Transport
  • 3 Network Internet
  • 2 Data Link Link / Network Access
  • 1 Physical Link / Network Access

Why collapse 5–7? Internet engineering historically treated formatting, sessions, and apps as host software concerns above TCP/UDP sockets. TLS is a good example: conceptually Presentation/Application in OSI talk, but operationally it is a library sitting above Transport in the TCP/IP worldview.

Exam scenario: “Which TCP/IP layer corresponds to OSI Network?” → Internet . “Which OSI layers map to TCP/IP Application?” → 5, 6, and 7 .

Encapsulation: Building the Packet

Encapsulation is the process of wrapping higher-layer data with lower-layer headers (and sometimes trailers) as data moves down the stack on the sending host.

Walkthrough — browser GET to https://example.mil :

Application creates an HTTP request (data).

TLS (often discussed with Application/Presentation) may encrypt that data.

Transport adds a TCP header (source/dest ports, sequence numbers, flags) → segment .

Internet adds an IP header (source/dest IP, TTL, protocol = TCP) → packet .

Link adds an Ethernet header (src/dest MAC, EtherType) and FCS trailer → frame , then Physical sends bits .

Mnemonic: as data goes down, headers are added ; as data goes up on the receiver, headers are removed ( de-encapsulation ).

  • Visual Order (Outside → Inside on the Wire)
  • [Ethernet HDR][IP HDR][TCP HDR][HTTP data][FCS]

Security tools inspect different shells: switches care about Ethernet; routers about IP; host firewalls about TCP ports; WAFs about HTTP.

De-encapsulation on the Receiver

The destination host reverses the process:

NIC receives bits → reconstructs frame; checks FCS.

If dest MAC matches (or promiscuous mode), strip Ethernet header; pass payload up.

IP layer verifies checksum/TTL concepts, confirms dest IP is local, strips IP header.

Transport demuxes by destination port to the correct socket.

Application receives the byte stream / datagram and parses HTTP.

If any check fails (wrong MAC, expired TTL at a router, closed port, bad TLS), delivery stops at that layer — another reason layered models matter for cyber troubleshooting.

What Happens at Each Router Hop?

Encapsulation is not “set once and forget.” At each hop:

The IP packet (Internet layer) is the unit routers forward.

Routers de-encapsulate the Layer-2 frame , make a Layer-3 decision, then re-encapsulate into a new Layer-2 frame for the next link (new MACs, possibly different media: Ethernet → serial → Ethernet).

IP addresses generally stay the same end-to-end (except NAT), while MAC addresses change every hop .

Exam trap: “Do MAC addresses stay constant across the Internet path?” → No. “Do IP addresses normally identify the end hosts across hops?” → Yes (without NAT).

Ports, Sockets, and Multiplexing

Transport encapsulation includes port numbers so one IP host can run many services:

Destination port 443 → typically HTTPS server socket.

Ephemeral source ports identify client conversations.

A socket is roughly {protocol, local IP, local port, remote IP, remote port} for TCP. Multiplexing/demultiplexing is why two browser tabs can talk to the same server simultaneously.

Connection-Oriented vs Connectionless (Encapsulation Implications)

TCP encapsulation supports handshake (SYN/SYN-ACK/ACK), sequencing, and ACKs — more header fields, more reliability.

UDP encapsulation is smaller — length and checksum — favoring DNS queries, VoIP, and low-overhead telemetry.

Choosing TCP vs UDP is a Transport decision that still rides inside the same IP/Ethernet shells.

Cyber-Relevant Capture Scenario

Analysts see a PCAP:

Ethernet: aa:bb:... → cc:dd:... , EtherType 0x0800 (IPv4).

IP: 10.1.1.5 → 8.8.8.8 , protocol TCP.

TCP: sport 53122 → dport 443 , flags ACK/PSH.

Payload: TLS records.

Interpretation: Link frames a local hop; Internet targets a public resolver/path; Transport aims at HTTPS; Application data is encrypted. Blocking at wrong layer wastes time — e.g., chasing HTTP content when you only have TLS ciphertext.

Quick Comparison Card

  • Concept OSI-centric wording TCP/IP-centric wording
  • Addressing hosts across nets Network layer Internet layer
  • Ports & reliability Transport Transport
  • HTTP/DNS Application Application
  • Ethernet/Wi-Fi Data Link + Physical Link / Network Access
  • Wrapping headers downward Encapsulation Encapsulation
  • Unwrapping upward De-encapsulation De-encapsulation

Master mapping + the hop-by-hop MAC rewrite story. Those two ideas unlock most Cyber Test questions on models and encapsulation without requiring vendor CLI trivia.