The TCP/IP model is the practical framework the internet actually runs on. It describes how data moves from an application on one device to an application on another, across any number of networks. While the OSI model is great for learning, engineers troubleshoot real networks with TCP/IP in mind.
This guide explains the four layers, the main protocols, how encapsulation works and how TCP/IP compares with OSI.
A little history
TCP/IP grew out of US research networks in the 1970s. On 1 January 1983, ARPANET switched to TCP/IP, which many consider the birth of the modern internet. RFC 1122 later described the model’s layers formally.
The four layers
| Layer | Purpose | Example protocols | Data unit |
|---|---|---|---|
| Application | Network services for applications | HTTP/HTTPS, DNS, SMTP, SSH, FTP, DHCP | Data / message |
| Transport | End-to-end delivery between programs | TCP, UDP, QUIC | Segment (TCP) / datagram (UDP) |
| Internet | Addressing and routing between networks | IPv4, IPv6, ICMP | Packet |
| Link (network access) | Delivery on the local network | Ethernet, Wi-Fi, ARP | Frame |
Some textbooks split the link layer into data link and physical layers, giving a five-layer version.
Application layer
This layer provides the services users notice: web browsing, email, file transfer and name resolution. It combines the jobs of the OSI application, presentation and session layers. For instance, TLS encryption for HTTPS sits here in practice.
Transport layer
The transport layer delivers data between programs using port numbers.
- TCP is reliable and connection-oriented: it uses a three-way handshake, numbers segments, acknowledges them and retransmits lost data.
- UDP is lightweight and connectionless, so it suits DNS queries, voice and video.
- QUIC, which runs over UDP, powers HTTP/3 with built-in encryption.
Internet layer
Here, IP gives every device a logical address and lets routers forward packets across networks. ICMP carries error and diagnostic messages, such as those used by ping and traceroute.
Link layer
The link layer moves frames over a physical network, such as Ethernet or Wi-Fi, using MAC addresses. ARP maps IPv4 addresses to MAC addresses on the local network.
Encapsulation
As data goes down the layers, each one adds its own header:
- The application creates data, for example an HTTP request.
- The transport layer adds a TCP header with source and destination ports.
- The internet layer adds an IP header with source and destination addresses.
- The link layer adds an Ethernet header and trailer with MAC addresses.
At the receiver, each layer removes its header and passes the rest upward. This is decapsulation.
TCP/IP vs OSI
| OSI layers | TCP/IP layer |
|---|---|
| 7 Application, 6 Presentation, 5 Session | Application |
| 4 Transport | Transport |
| 3 Network | Internet |
| 2 Data link, 1 Physical | Link |
OSI is a reference model with seven layers, useful for teaching and troubleshooting language. TCP/IP is the protocol suite that real networks use. Learn more in the OSI model and our OSI model analogy.
Example: opening a website
- DNS (application, over UDP) finds the server’s IP address.
- TCP sets up a connection to port 443, or QUIC over UDP for HTTP/3.
- TLS encrypts the session.
- HTTP requests the page.
- IP routes packets across the internet, and Ethernet or Wi-Fi carries them on each local link.
Troubleshooting with the model
- Link: is the cable plugged in or Wi-Fi connected?
- Internet: can you
pingthe gateway? Is the IP address correct? - Transport: is the port open? Try
nc -vz host 443. - Application: does DNS resolve? Does the service respond?
Sources
Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.
Pingback: Routing Categories - Youngster Company