← Back to Network Stacks Index

🌐 TCP/IP Model

The Internet Protocol Suite - Foundation of the Modern Internet

What is the TCP/IP Model?

The TCP/IP model (Transmission Control Protocol/Internet Protocol), also called the Internet Protocol Suite or DoD Model (Department of Defense), is the practical networking framework that actually powers the internet and most modern networks. Developed in the 1970s by DARPA for the ARPANET project, it predates the OSI model and focuses on real-world implementation rather than theoretical perfection.

Unlike the OSI model's seven layers, TCP/IP uses a simpler four-layer approach that maps more directly to how protocols are actually implemented in operating systems and network devices. While the OSI model is excellent for teaching and discussing networking concepts, TCP/IP is what you'll actually configure, troubleshoot, and implement in production networks.

Why TCP/IP Won: The battle between OSI and TCP/IP was decided in the 1980s-90s. TCP/IP succeeded because it was freely available, already implemented and working (on UNIX systems and the growing internet), and simpler to understand. OSI protocols were complex, expensive to license, and arrived too late to displace the entrenched TCP/IP. Today, we use TCP/IP protocols but often discuss them using OSI terminology - the best of both worlds.

🔄 TCP/IP vs OSI: The Key Differences

Aspect TCP/IP Model OSI Model
Layers 4 layers 7 layers
Development Developed by DARPA (1970s) Developed by ISO (1984)
Approach Protocol-oriented (practical) Generic, protocol-independent (theoretical)
Implementation Widely implemented (the internet) Rarely fully implemented
Usage Real-world networking Education and reference
Flexibility Less rigid, practical Strict layer separation
Session/Presentation Combined into Application layer Separate layers (5 & 6)

📚 The TCP/IP Protocol Suite

TCP/IP isn't just two protocols - it's an entire suite of protocols working together. Here's the family:

Core Protocols

  • IP: Internet Protocol (addressing and routing)
  • TCP: Transmission Control Protocol (reliable transport)
  • UDP: User Datagram Protocol (fast transport)
  • ICMP: Internet Control Message Protocol (errors and diagnostics)
Application Protocols
  • HTTP/HTTPS: Web traffic
  • SMTP/POP3/IMAP: Email
  • FTP/SFTP: File transfer
  • DNS: Name resolution
  • SSH: Secure shell
  • DHCP: IP configuration
Supporting Protocols
  • ARP: Address Resolution (MAC ↔ IP)
  • RARP: Reverse ARP
  • IGMP: Multicast group management
  • NTP: Time synchronization
Routing Protocols
  • RIP: Routing Information Protocol
  • OSPF: Open Shortest Path First
  • BGP: Border Gateway Protocol
  • EIGRP: Enhanced Interior Gateway
4

Application Layer

"Process-to-process communication and network services"

OSI Layers 5, 6, 7 Combined

The TCP/IP Application Layer combines the functions of OSI's Application, Presentation, and Session layers into one practical layer. This is where user applications interact with the network, where data is formatted and encrypted, and where sessions are managed. Most protocols you interact with daily operate at this layer.

Primary Functions

  • Provides network services to applications
  • Data formatting and encryption
  • Session establishment and management
  • Application-level protocols
  • User authentication and authorization
  • Data compression and encoding

Common Protocols by Service

  • Web: HTTP (80), HTTPS (443)
  • Email: SMTP (25), POP3 (110), IMAP (143)
  • File Transfer: FTP (20/21), SFTP (22)
  • Remote Access: SSH (22), Telnet (23), RDP (3389)
  • DNS: Domain Name System (53)
  • Network Management: SNMP (161/162)
  • Configuration: DHCP (67/68)
🌐 Real-World Example: Complete Web Request

When you type "https://www.example.com" in your browser, the Application Layer orchestrates multiple protocols:

  1. DNS Query: Browser asks DNS server "What's the IP of www.example.com?" (DNS protocol, UDP port 53)
  2. DNS Response: DNS server replies "It's 93.184.216.34" (IP address returned)
  3. TCP Connection: Browser initiates TCP three-way handshake to port 443 (HTTPS)
  4. TLS Handshake: Browser and server negotiate encryption (certificates, cipher suites)
  5. HTTP Request: Browser sends "GET / HTTP/1.1" request over encrypted connection
  6. HTTP Response: Server sends HTML page with status "200 OK"

All of this happens in milliseconds, with the Application Layer managing DNS, TLS encryption, and HTTP - three different protocols working together seamlessly.

🔧 Application Layer Troubleshooting
  • DNS Issues:
# Test DNS resolution $ nslookup example.com $ dig example.com +short $ host example.com
  • HTTP/HTTPS Issues:
# Test web server connectivity $ curl -v https://example.com $ wget --spider https://example.com $ telnet example.com 80
  • Email Issues:
# Test SMTP server $ telnet mail.example.com 25 # Then type: EHLO test.com # Test POP3/IMAP $ telnet mail.example.com 110 # POP3 $ telnet mail.example.com 143 # IMAP
  • Port Scanning:
# Check what services are listening $ nmap -sV example.com $ netstat -tuln # Local listening ports
Security Note: Most modern Application Layer protocols now use encryption (HTTPS instead of HTTP, IMAPS instead of IMAP, etc.). Always prefer encrypted variants when available. Port 443 (HTTPS) should be your default, not port 80 (HTTP).
3

Transport Layer

"Host-to-host communication: TCP reliability or UDP speed"

OSI Layer 4

The Transport Layer provides end-to-end communication services between applications running on different hosts. It's responsible for segmenting application data, establishing end-to-end connections (TCP), providing reliability and flow control, and multiplexing multiple applications using port numbers. This layer offers two main protocols with very different characteristics: TCP (reliable but slower) and UDP (fast but unreliable).

TCP - Transmission Control Protocol

  • Connection-oriented: Three-way handshake establishes connection
  • Reliable: Guaranteed delivery with acknowledgments
  • Ordered: Data arrives in sequence
  • Flow control: Prevents overwhelming receiver
  • Error checking: Checksums detect corruption
  • Retransmission: Lost packets are resent
  • Overhead: Higher due to reliability mechanisms
  • Use cases: Web (HTTP), email, file transfer, SSH
UDP - User Datagram Protocol
  • Connectionless: No connection establishment
  • Unreliable: No delivery guarantee
  • Unordered: Packets may arrive out of order
  • No flow control: Sends at whatever rate desired
  • Basic error checking: Checksums but no correction
  • No retransmission: Lost packets stay lost
  • Low overhead: Minimal header, maximum speed
  • Use cases: DNS, streaming, VoIP, gaming, DHCP
Port Number Ranges:
Well-known ports (0-1023): Reserved for standard services (HTTP, SSH, DNS)
Registered ports (1024-49151): Registered with IANA for specific services
Dynamic/Private ports (49152-65535): Used for client-side ephemeral ports
🔗 Real-World Example: TCP Three-Way Handshake

Establishing a connection to a web server:

  1. Client → Server (SYN):
    Client: "I want to connect. My sequence number starts at 1000."
    TCP flags: SYN=1, SEQ=1000
  2. Server → Client (SYN-ACK):
    Server: "OK, I'm ready. My sequence starts at 5000. I got your 1000."
    TCP flags: SYN=1, ACK=1, SEQ=5000, ACK=1001
  3. Client → Server (ACK):
    Client: "Great! I got your 5000. Let's start transferring data."
    TCP flags: ACK=1, SEQ=1001, ACK=5001

Connection established! Now HTTP data can flow. When done, a four-way teardown (FIN-ACK, FIN-ACK) gracefully closes the connection.

⚡ Real-World Example: UDP Streaming Video

When watching a live stream or video call, UDP is preferred over TCP. Here's why:

  • Speed matters: Dropping a frame occasionally is better than pausing to retransmit
  • Real-time requirement: Old data is useless (retransmitting a video frame from 2 seconds ago helps nothing)
  • Low latency: No connection setup, no waiting for acknowledgments
  • Human tolerance: Users don't notice a few dropped frames, but they do notice buffering/delays

Video codecs are designed to handle occasional packet loss gracefully, making UDP the perfect choice.

🔧 Transport Layer Troubleshooting

View Active Connections:

# Show all TCP connections $ netstat -ant $ ss -tan # Show all UDP "connections" $ netstat -anu $ ss -uan # Show listening ports $ netstat -tuln $ ss -tuln # Show connections with process info $ netstat -tulnp $ ss -tulnp

Test Port Connectivity:

# Test TCP port $ telnet example.com 80 $ nc -zv example.com 80 # Test UDP port (harder - no connection) $ nc -zvu example.com 53 # Scan ports $ nmap -p 1-1000 example.com

Analyze with Wireshark/tcpdump:

# Capture TCP traffic on port 80 $ tcpdump -i eth0 'tcp port 80' # Capture TCP handshakes $ tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn) != 0' # See connection states $ ss -tan state established $ ss -tan state time-wait
Choosing TCP vs UDP:
Use TCP when: Data accuracy is critical (file transfers, email, web pages, databases)
Use UDP when: Speed and low latency matter more than perfection (streaming, gaming, VoIP, DNS)
Modern approach: Some protocols use UDP with application-level reliability (QUIC, which HTTP/3 uses)
2

Internet Layer

"Routing packets across interconnected networks"

OSI Layer 3

The Internet Layer is the heart of the TCP/IP model, handling logical addressing (IP addresses), routing, and packet delivery across multiple networks. This layer is responsible for getting packets from the source host to the destination host, even if they're on different networks separated by multiple routers. The primary protocol is IP (Internet Protocol), supported by ICMP for error reporting and ARP for address resolution.

Primary Functions

  • Logical addressing (IP addresses)
  • Routing between networks
  • Packet forwarding and delivery
  • Fragmentation and reassembly
  • Path determination
  • Time to Live (TTL) management
Key Protocols
  • IPv4: 32-bit addresses (192.168.1.1)
  • IPv6: 128-bit addresses (2001:db8::1)
  • ICMP: Error messages and diagnostics
  • ARP: Maps IP to MAC addresses
  • IGMP: Multicast group management
  • IPsec: IP-level encryption
IPv4 Address Classes (historical):
Class A 0.0.0.0 - 127.255.255.255 (large networks)
Class B 128.0.0.0 - 191.255.255.255 (medium networks)
Class C 192.0.0.0 - 223.255.255.255 (small networks)
Class D 224.0.0.0 - 239.255.255.255 (multicast)
Class E 240.0.0.0 - 255.255.255.255 (reserved)
Modern approach: CIDR (Classless Inter-Domain Routing) - e.g., 192.168.1.0/24
📍 Real-World Example: IP Addressing and Subnetting

Your network uses the private IP range 192.168.1.0/24. Let's break this down:

  • Network: 192.168.1.0
  • Subnet mask: 255.255.255.0 (or /24 in CIDR)
  • Usable IPs: 192.168.1.1 - 192.168.1.254 (254 hosts)
  • Broadcast: 192.168.1.255
  • Default gateway: Typically 192.168.1.1 (your router)

The /24 means the first 24 bits are the network portion, leaving 8 bits (2^8 = 256 addresses) for hosts. Subnet 0 is the network address, 255 is broadcast, leaving 254 usable.

🛣️ Real-World Example: ICMP and Ping

When you ping a host, you're using ICMP (Internet Control Message Protocol):

$ ping -c 4 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=12.3 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=11.8 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=12.1 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=117 time=12.0 ms

This sends ICMP Echo Request packets and receives Echo Reply packets. The TTL (Time To Live) of 117 means the packet can pass through 117 more routers before being discarded. Round-trip time shows latency.

🔧 Internet Layer Troubleshooting

Basic Connectivity:

# Test basic IP connectivity $ ping 8.8.8.8 # Test DNS resolution and connectivity $ ping google.com # Continuous ping (Ctrl+C to stop) $ ping -t google.com # Windows $ ping google.com # Linux (runs until stopped) # Send specific number of packets $ ping -c 4 google.com

Trace Route Path:

# Show path packets take $ traceroute google.com # Linux $ tracert google.com # Windows # MTR - continuous traceroute $ mtr google.com

View Routing Table:

# Show routing table $ ip route show # Linux $ route print # Windows $ netstat -rn # Both # Show default gateway $ ip route | grep default $ route -n | grep '^0.0.0.0'

ARP Operations:

# View ARP cache (IP to MAC mappings) $ arp -a $ ip neighbor show # Clear ARP cache $ ip neighbor flush all # Linux $ arp -d * # Windows (requires admin)
IPv4 Exhaustion and IPv6: The world ran out of new IPv4 addresses years ago. IPv6 provides a virtually unlimited address space (2^128 addresses). While IPv4 still dominates, IPv6 adoption is growing. Modern networks should support both (dual-stack).
Private IP Ranges (RFC 1918):
These ranges are for private networks and not routed on the internet:
10.0.0.0/8 - 10.0.0.0 to 10.255.255.255 (16.7 million addresses)
172.16.0.0/12 - 172.16.0.0 to 172.31.255.255 (1 million addresses)
192.168.0.0/16 - 192.168.0.0 to 192.168.255.255 (65,536 addresses)
1

Network Access Layer

"Physical network hardware and data link protocols"

OSI Layers 1 & 2 Combined

The Network Access Layer (also called Link Layer or Network Interface Layer) combines OSI's Physical and Data Link layers. It handles the physical transmission of data over network hardware and manages the protocols needed to access the physical medium. This includes Ethernet, Wi-Fi, PPP, and other technologies that actually move bits on the wire or through the air.

Primary Functions

  • Physical addressing (MAC addresses)
  • Frame formatting and transmission
  • Media access control
  • Error detection (CRC)
  • Physical medium specifications
  • Bit-level transmission
  • Hardware interface control
Common Technologies
  • Ethernet: IEEE 802.3 (wired LAN)
  • Wi-Fi: IEEE 802.11 (wireless LAN)
  • PPP: Point-to-Point Protocol (dialup, DSL)
  • Frame Relay: WAN technology
  • ATM: Asynchronous Transfer Mode
  • Token Ring: IEEE 802.5 (obsolete)
  • FDDI: Fiber Distributed Data Interface
Ethernet Frame Structure:
Preamble (7 bytes) | SFD (1 byte) | Dest MAC (6 bytes) | Source MAC (6 bytes) | Type/Length (2 bytes) | Data (46-1500 bytes) | FCS/CRC (4 bytes)
🔌 Real-World Example: Ethernet Frame Delivery

When your computer (MAC: AA:BB:CC:DD:EE:01) sends data to a server on the local network (MAC: AA:BB:CC:DD:EE:02):

  1. Frame Creation: Network Access layer wraps the IP packet in an Ethernet frame
  2. Source MAC: Your NIC's MAC address (AA:BB:CC:DD:EE:01)
  3. Destination MAC: Server's MAC address (AA:BB:CC:DD:EE:02) - found via ARP
  4. Type Field: 0x0800 indicates IPv4 payload
  5. CRC Checksum: Calculated to detect transmission errors
  6. Transmission: Frame converted to electrical signals on the wire
  7. Switch Forwarding: Switch reads destination MAC, forwards to correct port
  8. Reception: Server NIC sees its MAC address, accepts frame
  9. Verification: CRC checked; if valid, frame passed up to IP layer
📡 Real-World Example: Wi-Fi (802.11)

Wireless networks face additional challenges that Ethernet doesn't:

  • Collision Avoidance: Can't detect collisions while transmitting (CSMA/CA instead of CSMA/CD)
  • Hidden Node Problem: Two stations can't hear each other but both can reach the AP
  • Signal Quality: Distance and obstacles affect transmission
  • Security: Wireless is broadcast; needs WPA2/WPA3 encryption
  • Association: Devices must authenticate with the access point before transmitting
🔧 Network Access Layer Troubleshooting

Check Physical Interface:

# Show network interfaces $ ip link show $ ifconfig -a # Show interface statistics (errors, drops) $ ip -s link show eth0 $ ifconfig eth0 # Check link status and speed $ ethtool eth0 $ mii-tool eth0

MAC Address Operations:

# Show MAC address $ ip link show eth0 $ ifconfig eth0 | grep ether # Show ARP table (IP to MAC mappings) $ arp -a $ ip neighbor show # On switches - view MAC address table switch# show mac address-table

Wireless Troubleshooting:

# Show wireless info $ iwconfig wlan0 # Scan for wireless networks $ iwlist wlan0 scan # Show wireless link quality $ wavemon # if installed # Check wireless authentication $ wpa_cli status

Capture Frame-Level Traffic:

# Capture Ethernet frames $ tcpdump -i eth0 -e # Show only ARP traffic $ tcpdump -i eth0 arp # Wireshark for detailed analysis $ wireshark &
Common Physical Layer Issues:
  • Bad cables (crimped wrong, damaged, wrong category)
  • Duplex mismatch (one end auto, other end forced to half-duplex)
  • Speed mismatch (100Mbps vs 1Gbps)
  • Excessive cable length (>100m for copper Ethernet)
  • Electromagnetic interference (near motors, fluorescent lights)
  • Bad port on switch/NIC
Ethernet Standards You Should Know:
10BASE-T 10 Mbps over Cat3 UTP, 100m max
100BASE-TX 100 Mbps (Fast Ethernet) over Cat5 UTP, 100m max
1000BASE-T 1 Gbps (Gigabit) over Cat5e/Cat6 UTP, 100m max
10GBASE-T 10 Gbps over Cat6a/Cat7, 100m max
1000BASE-SX 1 Gbps over multimode fiber, 550m max
10GBASE-SR 10 Gbps over multimode fiber, 300m max

🛠️ Putting It All Together: Complete Network Communication

Let's trace a complete web request through all four TCP/IP layers:

Scenario: User opens https://www.example.com in browser

Layer 4 - Application Layer:

  1. DNS query: "What's the IP of www.example.com?" → Response: "93.184.216.34"
  2. Browser initiates HTTPS connection (TLS handshake, certificate verification)
  3. HTTP request: "GET / HTTP/1.1" sent over encrypted connection

Layer 3 - Transport Layer:

  1. TCP three-way handshake to port 443 (SYN, SYN-ACK, ACK)
  2. HTTP request segmented into TCP segments
  3. Each segment gets source port (e.g., 52341) and destination port (443)
  4. Sequence numbers track data order; acknowledgments ensure delivery

Layer 2 - Internet Layer:

  1. TCP segments wrapped in IP packets
  2. Source IP: 192.168.1.100 (your computer), Destination IP: 93.184.216.34
  3. Router uses routing table to forward packet toward destination
  4. Each router decrements TTL; if TTL=0, packet discarded (prevents loops)
  5. Packet traverses 10-15 routers across the internet

Layer 1 - Network Access Layer:

  1. IP packet wrapped in Ethernet frame
  2. ARP resolves next hop's IP to MAC address
  3. Source MAC: Your NIC, Destination MAC: Gateway router's interface
  4. Frame transmitted as electrical signals on Ethernet cable
  5. Each router removes old Ethernet frame, creates new one for next hop
  6. Final hop delivers to web server's NIC

Return Journey:

The server's response follows the same process in reverse, passing down through its protocol stack, across the internet, and up through your computer's stack to the browser.

Key Takeaway: The TCP/IP model is what you actually configure and troubleshoot daily. While the OSI model provides excellent conceptual framework and terminology, TCP/IP reflects real-world implementation. A good network professional understands both: use OSI for discussion and theory, TCP/IP for implementation and troubleshooting.