Headers Everywhere

Each wrap is physically a header stuck in front of what came from above. On the wire, reading from the outside in, a web request looks like:

Ethernet header | IP header | TCP header | data

Each header carries that layer's addressing: the Ethernet header holds the MACs, the IP header the IP addresses and TTL, the TCP header the ports and sequence numbers.

This is why tools like Wireshark can dissect any capture: the nesting order is always the same, so each header tells the parser what comes next.