Leo provides a link with good information. But the question from the original poster seems to indicate a fundamental misunderstanding about encapsulation and I would like to respond to that part.
Encapsulation is a fundamental concept in the development of the layered model and in the implementation of the TCP/IP stack. The original question seems to assume that encapsulation happens at one layer or the other. But the reality is that encapsulation happens multiple times at multiple layers. The original data payload is produced in the application that is running. The original data payload is encapsulated at the data link layer, where the addressing in the encapsulation is based on the protocol port numbers. Then encapsulation happens again at the networking layer where the addressing in the encapsulation is based on IP addresses. Then encapsulation happens again at the data link layer where the addressing in the encapsulation is based on MAC addresses (assuming that the data link layer is using Ethernet).
encapsulation is important at each of these layers and if it did not happen at a particular layer then our ability to forward the data would be impacted in a negative way.
HTH
Rick
HTH
Rick
