How Is a Packet Encapsulated and Decapsulated?

Tunneling

• The processing of protecting entire packets from snoopers is called tunneling. Tunneling can also be used to carry data packets formed following one network protocol system over a stretch of network adhering to a different network protocol system. It involves embedding an entire packet in the data payload (the body) of another packet. The terms “tunneling” and “encapsulation” are interchangeable.
  
  

Process

• As data packets are formed, they become subject to procedures dictated by different protocols. A transport protocol first forms a packet and then places its header on the front. Procedures of the Internet Protocol then take over and put an IP header on the front, which contains the source and destination IP address. This is the complete packet that will be carried in the body of another data packet. The process then loops around again. If encapsulation is taking place to improve security, the entire packet is encrypted. This renders all the address information in the IP header unusable. The carrying packet compensates for this disabling of routing information. Another transport header goes on the front of the packet, transforming the encrypted packet into a data payload. The IP procedures then put another IP header on the front of the packet so that it can be transported.
  
  

Journey

• Encapsulation is the key to the creation of a virtual private network. The packet has a destination on a private network, but that network is geographically split. The tunneling packet carries the encapsulated packet for a stretch of its journey that crosses a public medium, like the Internet. This maintains the same level of privacy for the packet as though it had never left a private network.
  
  

Arrival

• Data encapsulation only occurs after sender and receiver have negotiated encryption keys. Therefore, the receiving gateway already knows how to decrypt the packets. The outer packet achieves its goal by getting the embedded packet to the destination network's gateway. It is then stripped off, leaving an encrypted packet. The gateway decrypts the data packet, returning it to its original form. Now the packet is decapsulated. This packet can then continue its journey over the private network using its original IP header, which becomes operational on decryption.