When network professionals discuss data flowing through networks, they use precise terminology that reflects which layer's perspective they're taking. A database query doesn't simply become "a packet"—it transforms through multiple representations as it traverses the network stack.

The formal term for data at any given layer is a Protocol Data Unit (PDU). Understanding PDUs isn't just academic precision—it's essential for:

• Clear communication — Saying "TCP segment" vs. "IP packet" conveys exactly which headers are relevant
• Debugging — Identifying whether a problem is at layer 2, 3, or 4 guides troubleshooting
• Protocol design — Understanding PDU boundaries helps design efficient protocols
• Security analysis — Attacks often target specific PDU types

This page establishes the complete PDU vocabulary and shows how data transforms as it moves through the network stack.

A Protocol Data Unit (PDU) is the fundamental unit of data at a specific protocol layer. It consists of:

1. Protocol Control Information (PCI) — The header (and possibly trailer) added by that layer
2. Service Data Unit (SDU) — The payload received from the layer above

Expressed mathematically:

PDU_n = Header_n + SDU_n + Trailer_n (if applicable)

where SDU_n = PDU_(n+1)  (the PDU from the layer above)

The Recursive Nature:

This relationship is beautifully recursive. The TCP segment (Layer 4 PDU) becomes the IP packet's payload (Layer 3 SDU). The IP packet (Layer 3 PDU) becomes the Ethernet frame's payload (Layer 2 SDU). Each layer treats the PDU from above as an opaque blob of data—the SDU.

Why This Matters:

This abstraction enables layer independence. The IP layer doesn't know or care whether its payload is TCP, UDP, ICMP, or something else entirely. It simply receives an SDU, adds its header to create a PDU, and passes it down. This is the power of encapsulation realized through PDUs.

The PDU Hierarchy:

Each layer's PDU has a specific name that reflects its function:

• Application Layer → Data / Message / Stream
• Transport Layer → Segment (TCP) or Datagram (UDP)
• Network Layer → Packet or Datagram
• Data Link Layer → Frame
• Physical Layer → Bits / Symbols

These aren't arbitrary—each name reflects the layer's purpose and processing model.

Let's examine the standard PDU terminology for both the OSI and TCP/IP models.

Layer 7 - Application Data:

At the application layer, data takes application-specific forms:

• HTTP: Request/Response messages
• SMTP: Email messages
• DNS: Query/Response messages
• FTP: Commands and file data

The generic term is "data" or "message," but each protocol defines its own structure.

Layer 4 - Transport PDUs:

Segment (TCP): TCP organizes data as a continuous byte stream but transmits it in segments. Each segment contains a portion of the stream plus TCP header. The term "segment" reflects TCP's segmentation of application data.

Datagram (UDP): UDP messages are discrete, self-contained units. Each UDP datagram is independent—there's no stream concept, no ordering guarantee, no relationship to other datagrams. The term "datagram" emphasizes this independence.

Layer 3 - Network PDUs:

Packet: The general term for a Layer 3 PDU. An IP packet contains the IP header plus its payload (typically a transport segment).

Datagram: Sometimes used interchangeably with packet, especially for connectionless protocols. IPv4 is technically called the "Internet Datagram" in RFC 791.

Layer 2 - Data Link PDUs:

Frame: A complete Layer 2 unit including header, payload, and trailer. The term "frame" suggests a boundary or container—framing the data for transmission. Ethernet frames, Wi-Fi frames, PPP frames are all examples.

Layer 1 - Physical PDUs:

Bits: The fundamental unit of digital information (0 or 1).

Symbols: In multi-level signaling, a symbol may represent multiple bits. For example, QAM-256 encodes 8 bits per symbol.

Let's trace the complete transformation of application data into physical signals, showing each PDU transition.

Step-by-Step Transformation:

Step 1: Application → Transport

The application creates data (e.g., an HTTP request). It passes this to the transport layer via a socket. The transport layer:

• May segment large data into multiple PDUs (TCP)
• Adds transport header (source port, dest port, etc.)
• Creates Segment (TCP) or Datagram (UDP)

Step 2: Transport → Network

The transport PDU becomes the network layer's payload (SDU). The network layer:

• Adds IP header (source IP, dest IP, TTL, etc.)
• May fragment if larger than path MTU
• Creates Packet (IP datagram)

Step 3: Network → Data Link

The IP packet becomes the data link layer's payload (SDU). The data link layer:

• Adds frame header (source MAC, dest MAC, EtherType)
• Adds frame trailer (FCS checksum)
• Creates Frame

Step 4: Data Link → Physical

The frame is converted to physical signals:

• Bits encoded using line coding (Manchester, 8B/10B, etc.)
• Preamble added for synchronization
• Transmitted as electrical, optical, or radio signals

The Reverse at the Receiver:

At the destination, the process reverses (decapsulation):

• Physical layer receives signals → reconstructs frame
• Data link layer strips frame header/trailer → extracts packet
• Network layer strips IP header → extracts segment
• Transport layer strips transport header → delivers data to application

Each layer has size constraints on its PDU, creating a cascade of limitations that affect network performance.

Maximum Transmission Unit (MTU):

The MTU is the largest PDU that a data link layer can transmit. It varies by technology:

The Cascading Effect:

MTU constrains all inner PDUs:

• Ethernet MTU: 1500 bytes
• Maximum IP packet payload: 1500 bytes
• With IPv4 header (20 bytes): 1480 bytes for transport
• With TCP header (20 bytes): 1460 bytes for application (TCP MSS)
• With typical TCP options: ~1400-1440 bytes usable

Fragmentation:

When a packet exceeds the path MTU, fragmentation occurs:

IPv4 Fragmentation:

• Router can fragment packets that are too large
• Each fragment gets its own IP header with fragmentation fields
• Reassembly happens at destination
• Fragment loss requires retransmitting entire original packet

IPv6 No Fragmentation by Routers:

• Only the source host can fragment
• Routers drop oversized packets and return ICMP "Packet Too Big"
• Source must discover path MTU and segment accordingly

Path MTU Discovery (PMTUD):

Hosts discover the smallest MTU on the path:

1. Send packets with Don't Fragment (DF) bit set
2. If a router can't forward, it returns ICMP "Fragmentation Needed"
3. Host reduces packet size and retries
4. Process repeats until packet succeeds

Problems with PMTUD:

• ICMP may be blocked by firewalls
• Black holes occur when ICMP is blocked but large packets are dropped
• TCP MSS clamping often used as workaround

Different network devices process different PDUs. Understanding this is crucial for network design and troubleshooting.

Layer 1 - Hubs and Repeaters:

Process: Bits

• Receive electrical/optical signals
• Regenerate and retransmit
• No frame awareness—just amplify signals
• Every bit goes to every port

Layer 2 - Switches and Bridges:

Process: Frames

• Read frame headers (MAC addresses)
• Make forwarding decisions based on destination MAC
• Learn which MACs are reachable through which ports
• Strip preamble/SFD, verify FCS, then forward
• Do NOT examine IP headers or ports

Layer 3 - Routers:

Process: Packets

• Receive complete frame, extract packet
• Read IP header (source/destination IP, TTL)
• Consult routing table for next hop
• Decrement TTL, recompute checksum
• Create NEW frame with next-hop MAC addresses
• The IP packet payload is never examined (in basic routing)

Layer 4 - Firewalls and Load Balancers:

Process: Segments/Datagrams

• Examine transport headers (ports, flags)
• Make decisions based on connection state
• May modify packets (NAT, port translation)
• Stateful devices track TCP connections

Key Insight: Frame Reconstruction at Each Hop:

When a packet traverses multiple networks:

1. Source creates Frame_1 with local MACs
2. Router receives Frame_1, extracts Packet
3. Router creates Frame_2 with different MACs (router to next hop)
4. Process repeats at each router
5. Final router creates Frame_n destined for target's MAC

The IP packet remains constant (except TTL), but frames change at every hop. This is the fundamental difference between Layer 2 and Layer 3 addressing:

• MAC addresses: hop-by-hop (change each link)
• IP addresses: end-to-end (constant source to destination)

Protocol overhead—the bytes consumed by headers and trailers—directly impacts network efficiency. Understanding PDU efficiency helps optimize applications and protocols.

Calculating Protocol Overhead:

For a standard TCP/IP transmission over Ethernet:

Efficiency Calculation:

For maximum-size Ethernet frame (1500 bytes payload):

• Usable application data: 1500 - 20 - 20 - 12 = 1448 bytes
• Total on wire: 1448 + 90 = 1538 bytes
• Efficiency: 1448/1538 = 94.1%

For minimum-size Ethernet frame (46 bytes payload + padding):

• Usable application data: Could be just 1 byte (with 45 bytes padding)
• Total on wire: 1 + 90 + 45 = 136 bytes
• Efficiency: 1/136 = 0.7%

The Small Message Problem:

For interactive applications (SSH keystrokes, game inputs, TCP ACKs):

• Payload: ~1-10 bytes
• Overhead: 90 bytes
• Efficiency: 1-10%

This is why:

• Nagle's algorithm combines small TCP segments
• SSH multiplexes multiple channels
• Games batch state updates
• TCP uses delayed ACKs

Jumbo Frames and Efficiency:

With 9000-byte jumbo frames:

• Usable data: 9000 - 52 = 8948 bytes
• Total: 8948 + 90 = 9038 bytes
• Efficiency: 8948/9038 = 99.0%

Data centers use jumbo frames to maximize efficiency for large transfers.

Modern protocols sometimes blur traditional layer boundaries to improve efficiency or provide new features.

QUIC: Merging Transport and Security:

Google's QUIC protocol (now HTTP/3) combines:

• UDP as the Layer 4 transport (for NAT traversal)
• TLS-like encryption integrated into the protocol
• HTTP/2-like stream multiplexing

QUIC PDU structure:

• UDP datagram containing QUIC packet(s)
• QUIC packet contains encrypted frames
• Frames carry stream data, ACKs, or control info

Why merge layers? Reduces round-trips, enables 0-RTT connection establishment, and allows encryption of more metadata.

HTTP/2 and HTTP/3 Framing:

HTTP/2 introduced its own framing layer:

• DATA frames carry message bodies
• HEADERS frames carry headers
• Multiple streams multiplexed on single TCP connection

The HTTP/2 frame is an application-layer PDU that doesn't map to traditional layers.

MPLS: Shim Layer Between 2 and 3:

Multiprotocol Label Switching inserts a label stack between Ethernet and IP:

• Ethernet frame contains MPLS header(s)
• MPLS header(s) contains IP packet

The MPLS label isn't quite Layer 2 or Layer 3—it's sometimes called "Layer 2.5."

Tunneling Creates Nested PDUs:

VPNs and overlay networks create deeply nested PDU structures:

VXLAN Example:

• Outer Ethernet frame (L2)
• Outer IP packet (L3)
• UDP datagram (L4)
• VXLAN header (8 bytes)
• Inner Ethernet frame (L2)
• Inner IP packet (L3)
• Transport segment (L4)
• Application data (L7)

This is encapsulation inside encapsulation—sometimes called "inception networking."

GRE Tunneling:

• Outer IP packet (L3)
• GRE header (4-16 bytes)
• Inner IP packet (L3)
• ... Inner layers ...

The inner packet is transported across networks that may not understand its addressing scheme.

Protocol Data Units provide the vocabulary for precise discussion of network data. Let's consolidate the key points:

What's Next:

Now that you understand how data is named and structured at each layer, the next page examines the reverse process: decapsulation—how receiving hosts strip away layers to recover the original application data, and how intermediate devices partially decapsulate to make forwarding decisions.