Master protocol data units networking with a plain-English OSI crash course: why PDU names change by layer, how encapsulation works, and how to explain it.
Everyone memorizes the OSI model layers. Protocol data units networking is where the model stops being a list and starts making sense — and it's also where most beginners quietly zone out because the term "PDU" sounds like one more thing to memorize on top of everything else. It isn't. A protocol data unit is just data wearing the right packaging for the layer it's traveling through. Once that clicks, the whole model snaps into place.
What a PDU Is When You Strip Away the Jargon
The confusion usually starts with the word "unit." It sounds like a distinct object, something separate from the data itself. It's not. The PDU is the data — just described from the perspective of the layer handling it at that moment.
The Envelope Analogy That Actually Helps
Think about mailing a letter. The words you wrote are the actual message. But before it gets delivered, it goes inside an envelope with your address, the recipient's address, and a stamp. At the post office, that envelope gets sorted into a bin with a routing slip. At the distribution center, the bin gets loaded into a truck with a manifest. The words never changed — but the packaging did, and each layer of packaging carried exactly the information that layer needed to do its job.
A protocol data unit works the same way. The application data — your HTTP request, your email, your DNS query — is the letter. Every layer below it adds its own envelope: a header, sometimes a trailer, carrying the addressing and control information that layer needs. The name "PDU" just means "data as this layer sees it, with this layer's packaging attached."
Why Beginners Keep Overthinking the Term
The real mistake is treating PDU as a separate concept rather than a label for something that's already happening. When your textbook says "the Transport layer PDU is a segment," it's not introducing a new object — it's just telling you what the Transport layer calls the data it's working with. The data is the same data. The name reflects the layer's job.
This is why the term changes at every layer. It's not arbitrary renaming. It's the model telling you which wrapper is in focus right now.
What This Looks Like in Practice
Say your browser sends an HTTP GET request for a webpage. At the Application layer, that request is just data — sometimes called a message. By the time it reaches the Transport layer, TCP has added a header with source and destination port numbers, turning it into a segment. The Network layer wraps that segment in an IP header with source and destination IP addresses — now it's a packet. The Data Link layer adds a frame header and trailer with MAC addresses — now it's a frame. The Physical layer converts the whole thing into bits and puts it on the wire.
In a packet capture lab, you can watch this happen in reverse. Open Wireshark on a live interface and filter for HTTP traffic. Click on any packet and expand the protocol tree at the bottom. You'll see the Ethernet frame header at the top, the IP header below it, the TCP segment inside that, and the HTTP data at the bottom. The same bytes, described from four different layers simultaneously. That's protocol data units networking made visible.
Cisco's networking fundamentals documentation uses this same layered framing to explain why each layer's PDU carries only the headers it needs — a clean principle that holds across both the OSI and TCP/IP models.
Why the OSI Layer Changes the PDU Name
The OSI model has seven layers, and each one has a defined PDU name. Understanding why the names differ is more useful than memorizing the list cold.
The Name Changes Because the Job Changes
Layer 4 (Transport) is responsible for end-to-end communication between applications — it needs port numbers, sequence numbers, and acknowledgment flags. Layer 3 (Network) is responsible for routing between networks — it needs IP addresses and TTL values. Layer 2 (Data Link) is responsible for hop-to-hop delivery within a single network segment — it needs MAC addresses and error-checking trailers. Each layer adds different information because it's solving a different problem. Calling the data by a different name at each layer is the model's way of flagging which problem is being solved right now.
OSI Layer-by-Layer PDU Names at a Glance
Here are the OSI layer PDU names mapped cleanly, without the textbook clutter:
- Layer 7 / Application — Data (or Message)
- Layer 6 / Presentation — Data
- Layer 5 / Session — Data
- Layer 4 / Transport — Segment (TCP) or Datagram (UDP)
- Layer 3 / Network — Packet
- Layer 2 / Data Link — Frame
- Layer 1 / Physical — Bits
Layers 5–7 are often grouped together in practice, especially in the TCP/IP model, where they collapse into a single Application layer. The important names to lock in are the bottom four: bits, frames, packets, and segments. Those are the ones that show up in interview questions, exam questions, and real troubleshooting.
What This Looks Like in Practice
Screenshot this mapping and keep it next to your notes. When you're studying encapsulation, trace a message downward through this list. When you're studying decapsulation, trace it back up. The chart isn't just for memorization — it's a reference for understanding which header is being added or removed at each step.
The CompTIA Network+ study guide covers these OSI layer PDU names as a core exam objective, which means they're tested directly. Getting the layer-to-name mapping right isn't optional if you're sitting for that cert.
Follow One Message Down the Stack, Then Back Up Again
Encapsulation and decapsulation are the two directions of the same process. Most explanations cover encapsulation well and then rush through decapsulation. Both matter.
Encapsulation Is Just Layering on the Delivery Instructions
When data moves from the Application layer down to the Physical layer, each layer adds its own header (and sometimes a trailer) before passing the data to the layer below. This is encapsulation. The data doesn't get replaced — it gets wrapped. The Transport layer doesn't know what's inside the application data; it just adds its own TCP or UDP header and passes the whole thing down. The Network layer doesn't know what's in the TCP segment; it adds an IP header and passes it down. Each layer treats the layer above's PDU as its payload.
This is why "encapsulation" is the right word. Each layer encapsulates the one above it, the way an envelope encapsulates a letter.
Decapsulation Is Where the Labels Get Peeled Off
On the receiving end, the process runs in reverse. The Physical layer receives bits and passes them up. The Data Link layer reads the frame header, checks the MAC address, strips the frame header and trailer, and passes the remaining data up to the Network layer. The Network layer reads the IP header, checks the destination IP, strips the IP header, and passes the segment up. The Transport layer reads the TCP or UDP header, routes the data to the right application port, strips the transport header, and passes the application data up. By the time the data reaches the Application layer, all the delivery packaging is gone — only the original message remains.
This reverse process is called decapsulation, and it's why routers and switches only need to read headers at their own layer. A router doesn't need to understand the TCP segment inside the packet — it only needs the IP header. That separation of concerns is one of the most elegant things about the layered model.
What This Looks Like in Practice
Loading a webpage gives you the full sequence. Your browser generates an HTTP GET request (Application layer data). TCP wraps it in a segment with your browser's ephemeral port and the server's port 443. IP wraps that in a packet with your IP and the server's IP. Ethernet wraps that in a frame with your MAC address and your router's MAC address. The frame hits the wire as bits.
At the server end, the process inverts. The NIC receives bits, the Data Link layer reads the Ethernet frame, the Network layer reads the IP packet, the Transport layer reads the TCP segment, and the web server application receives the HTTP request. In a Wireshark capture of this exchange, you can watch the encapsulation and decapsulation play out frame by frame — the protocol tree expands exactly the way the stack does.
Packet, Frame, Segment, and Datagram Are Not the Same Thing
This is where a lot of beginners quietly develop a bad habit: using packet, frame, and segment interchangeably because they all mean "a chunk of network data." They don't mean the same thing, and using them wrong in an interview or exam will cost you.
Stop Using the Words as if They All Mean the Same Thing
"Packet" is the most commonly misused term. In casual conversation, people say "packet" to mean any PDU at any layer. Technically, a packet is the Network layer PDU — it has an IP header and is routed between networks. A frame is the Data Link layer PDU — it has MAC addresses and moves between nodes on the same network segment. A segment is the Transport layer PDU for TCP. Using "packet" when you mean "frame" isn't just imprecise — it signals that you don't know which layer you're talking about, which is exactly what an interviewer is testing for.
The practical rule: always ask which layer you're describing, then use the name that belongs to that layer.
TCP Segment vs UDP Datagram
Both are Transport layer PDUs, but the names reflect different delivery models. A TCP segment carries sequence numbers, acknowledgment numbers, and flags that support reliable, ordered delivery. The word "segment" implies that the data has been divided into ordered pieces that can be reassembled. A UDP datagram carries source and destination ports and a checksum — and nothing else. No sequencing, no acknowledgment, no guaranteed delivery. The word "datagram" implies a self-contained unit that goes out and either arrives or doesn't.
The name difference isn't cosmetic. It encodes the protocol's contract with the application.
What This Looks Like in Practice
Run a packet capture while downloading a large file over HTTP and while doing a DNS lookup simultaneously. The file transfer uses TCP — you'll see segments with sequence numbers incrementing, acknowledgments coming back, and retransmissions if anything drops. The DNS query uses UDP — you'll see a single datagram go out and a single datagram come back, no handshake, no sequence numbers. Same transport layer, two different PDU types, two different jobs. The IETF RFC for TCP (RFC 793) and the RFC for UDP (RFC 768) define these differences at the protocol level if you want the authoritative source.
MTU Is Where the Theory Starts Hitting the Wire
MTU — Maximum Transmission Unit — is the point where PDU theory stops being abstract and starts causing real problems on real networks.
Why Packet Size Matters More Than People Expect
Every network interface has a maximum PDU size it can handle at the Data Link layer. For standard Ethernet, that limit is 1500 bytes. This is the MTU. If an IP packet is larger than 1500 bytes, something has to give — either the packet gets fragmented into smaller pieces, or it gets dropped and the sender gets an ICMP "fragmentation needed" message back.
MTU matters because applications don't always know (or care) about the underlying network's limits. A large file transfer, a VPN tunnel, or a misconfigured jumbo frame setting can all generate packets that exceed the path MTU, causing silent performance degradation or outright connectivity failures.
Fragmentation Happens When the Network Has No Choice
When a router receives a packet larger than the MTU of the outgoing interface, it has two options: fragment the packet or drop it and send an ICMP error. Fragmentation splits the original IP packet into smaller packets, each with its own IP header, and reassembles them at the destination. The reassembly happens at the receiving host, not at intermediate routers — which means if one fragment is lost, the entire original packet has to be retransmitted.
Fragmentation is often a symptom of a path MTU mismatch, not an intended behavior. In modern networks, path MTU discovery (PMTUD) is supposed to prevent it by negotiating the smallest MTU along the path before large packets are sent. When PMTUD breaks — usually because ICMP is being filtered — fragmentation problems appear as mysterious packet loss or slow throughput on specific connections.
What This Looks Like in Practice
Set your ping packet size to 1472 bytes on a standard Ethernet network (1472 bytes of data + 20 bytes IP header + 8 bytes ICMP header = 1500 bytes, exactly at the MTU). The ping goes through cleanly. Now try 1473 bytes of data. With the DF (Don't Fragment) bit set, the packet gets dropped and you get "fragmentation needed" back. Without the DF bit, the packet gets fragmented. In a Wireshark capture, you'll see the fragmented packets with the "More Fragments" flag set on all but the last piece — and the Fragment Offset field showing where each piece fits in the original. RFC 791 defines IP fragmentation behavior in detail, including the header fields that make reassembly possible.
Give Yourself a 30-Second Answer You Can Actually Remember
Knowing the concept is one thing. Being able to explain it under pressure — in an exam, in an interview, in a study group where someone asks you to just explain it — is the practical payoff.
The Interview Version Needs to Be Shorter Than the Textbook Version
The textbook version covers all seven OSI layers, the TCP/IP model comparison, fragmentation edge cases, and historical context. The interview version needs to do one thing: show the interviewer that you understand what the term means and why it matters. That means starting with the core idea, giving one concrete example, and stopping.
The core idea for protocol data units networking: a PDU is the data at a given network layer, including whatever headers and trailers that layer has added. The name changes at each layer because the layer's job changes.
A Memory Trick for the Layer Names
The bottom four PDU names are the ones worth locking in: Bits, Frames, Packets, Segments — from Physical up to Transport. A simple mnemonic: "Big Friendly Packet Senders." Each first letter maps to a layer going up: Bits (Physical), Frames (Data Link), Packets (Network), Segments (Transport). It's not elegant, but it works at 9am before a certification exam.
For the layers above Transport (Session, Presentation, Application), the PDU is just called "data" — no special name needed, because those layers don't add routing or addressing headers in the same way.
What This Looks Like in Practice
If an interviewer asks "what is a protocol data unit?", here's the answer that lands:
"A PDU is just data plus the header information a specific network layer adds so it can be moved across the network. At the Transport layer, TCP calls it a segment. At the Network layer, it's a packet with an IP header. At the Data Link layer, it's a frame with MAC addresses. The name changes because the layer's job changes — each one adds what it needs and passes the rest down."
That's it. Under 60 seconds. It covers the definition, the layer mapping, and the reason the names differ. It shows you understand the concept, not just the vocabulary.
How Verve AI Can Help You Prepare for Your Interview With Protocol Data Units Networking
The structural problem with networking interviews isn't knowing the material — it's translating a concept you understand into a clear, concise answer under live pressure. Most candidates who know what a PDU is still fumble the explanation because they've never had to say it out loud to someone who can follow up. That's a rehearsal problem, not a knowledge problem.
What actually fixes it is a tool that can hear your answer, respond to what you actually said, and push back the way a real interviewer would — not a static flashcard that accepts any answer. Verve AI Interview Copilot is built on exactly that premise. It listens in real-time to your spoken answer, identifies where the explanation gets vague or skips a step, and surfaces a follow-up the way a technical interviewer would. If you say "a PDU is data at a network layer" and stop there, Verve AI Interview Copilot will ask you to explain why the name changes — because that's what an interviewer would do. The practice loop is the actual interview loop, not a simulation of it. For networking concepts like encapsulation, MTU, and OSI layer mapping, where the answer needs to be both accurate and concise, Verve AI Interview Copilot suggests answers live so you can hear what a clean explanation sounds like before you're in the room.
FAQ
Q: What is a protocol data unit in plain English?
A PDU is data plus the packaging a specific network layer adds so it can be moved and understood across a network. The same underlying data gets a different name at each layer because each layer adds different headers and trailers for its specific job.
Q: Why does the PDU name change at different network layers?
Because each layer is doing different work. The Transport layer adds port numbers and sequencing information; the Network layer adds IP addresses for routing; the Data Link layer adds MAC addresses for local delivery. The name reflects which layer's packaging is currently in focus.
Q: What are the PDU names for the OSI and TCP/IP layers?
For the OSI model: Physical = Bits, Data Link = Frame, Network = Packet, Transport = Segment (TCP) or Datagram (UDP), Session/Presentation/Application = Data. The TCP/IP model collapses the top three OSI layers into a single Application layer, but the bottom four PDU names stay the same.
Q: How do encapsulation and decapsulation work in a real message flow?
Encapsulation is the process of each layer adding its own header (and sometimes trailer) as data moves down the stack toward the wire. Decapsulation is the reverse: each layer on the receiving side reads its header, strips it, and passes the remaining data up to the next layer. By the time data reaches the Application layer at the destination, all delivery packaging has been removed.
Q: What is the difference between a PDU, packet, frame, segment, and datagram?
PDU is the general term for data at any layer. A packet is specifically the Network layer PDU, carrying IP headers. A frame is the Data Link layer PDU, carrying MAC addresses. A segment is the Transport layer PDU for TCP. A datagram is the Transport layer PDU for UDP. Using these terms interchangeably signals a layer confusion that technical interviewers will catch.
Q: How do MTU and fragmentation affect PDUs in practice?
MTU is the maximum PDU size a network interface can handle — 1500 bytes for standard Ethernet. When an IP packet exceeds the MTU of an outgoing interface, it either gets fragmented into smaller packets or dropped. Fragmentation adds overhead and can cause performance problems, especially when path MTU discovery is blocked by ICMP filtering.
Q: How would you explain PDUs in a networking interview in 30 seconds?
"A PDU is data plus the headers a network layer adds so it can be routed and delivered. The name changes at each layer — segment at Transport, packet at Network, frame at Data Link, bits at Physical — because each layer adds different addressing and control information. Encapsulation is the process of adding those headers going down the stack; decapsulation is removing them on the way back up."
Conclusion
The envelope idea is the one worth keeping. Every layer in the network stack is just adding the label it needs to get data one step closer to its destination — and the term "protocol data unit" is just the name for data at whatever stage of that labeling process you're looking at. You can now explain that cleanly, map the layer names without freezing, and talk about MTU and fragmentation as practical consequences of packet size rather than abstract exam topics.
The real test isn't the definition. It's whether you can trace one message from your browser to a web server and back — naming what the data is called at each layer and why. If you can do that, you already understand protocol data units networking. The vocabulary is just the shorthand for a process you now actually see.
Drew Sullivan
Interview Guidance
