TCP/IP Reference Model: Layers, Protocols, Encapsulation, and OSI Comparison
Learn the four TCP/IP reference model layers, their responsibilities, common protocols, encapsulation, troubleshooting uses, and comparison with the seven-layer OSI model.
The TCP/IP reference model is a layered framework for describing how networked systems communicate. It gives network designers, engineers, and students a common structure for understanding, designing, and implementing networking protocols.
The model is closely associated with the TCP/IP protocol suite used by modern IP networks and the Internet. It originated from networking work sponsored by DARPA and was designed as an open, vendor-neutral approach rather than a model controlled by one hardware or software vendor.
A layered model does not mean that a computer literally contains four separate networking devices. Instead, it organizes related functions. Each layer has a distinct responsibility and provides services to the layer above it. When data is sent, it moves down the layers. When data is received, it moves back up the layers.
The Four TCP/IP Layers
From top to bottom, the four layers are:
- Application — network services and protocols used by application software.
- Transport — communication between application processes on end hosts.
- Internet — logical addressing and packet forwarding between networks.
- Link — local delivery, framing, media access, and transmission across a network link.
| TCP/IP layer | Primary purpose | Alternate name | Example protocols or technologies |
|---|---|---|---|
| Application | Network services for applications and application communication | None | HTTP, SMTP, POP3 |
| Transport | End-to-end host and process communication | Host-to-Host | TCP, UDP |
| Internet | Logical addressing and routing between networks | None | IP |
| Link | Local network delivery and media/interface communication | Network Access | Ethernet, PPP |
Application Layer
The Application layer supplies network-facing services used by application software. It supports communication between applications, such as a web browser communicating with a web server or a mail client communicating with a mail server.
Common Application layer protocols include:
- HTTP — used for web communication.
- SMTP — used to send or transfer email.
- POP3 — used by clients to retrieve email.
An application and an application protocol are not the same thing. For example, a web browser is an application, while HTTP is a protocol that the browser can use to exchange web content. The Application layer also groups functions that the OSI model describes separately as its Application, Presentation, and Session layers. These functions include application services, data representation, and management of communication sessions.
Transport Layer
The Transport layer provides end-to-end, host-to-host delivery services for application processes. It can identify the intended application using port numbers and can provide services such as reliability, ordering, flow control, or low-overhead delivery.
This layer is also called the Host-to-Host layer. Its two core protocols are TCP and UDP.
TCP
Transmission Control Protocol (TCP) is connection-oriented. It establishes a transport connection and can provide reliable, ordered delivery. Its mechanisms include sequencing, acknowledgments, retransmission of missing data, and flow control when appropriate.
TCP reliability is a service provided by TCP specifically. It is not a guarantee made by every Transport layer protocol.
UDP
User Datagram Protocol (UDP) is connectionless and best-effort. It has lower overhead than TCP and does not inherently provide acknowledgments, retransmissions, or ordered reliable delivery. Applications may choose UDP when low delay and simple transmission are more important than automatic recovery of lost data, as can occur with some voice, video, or real-time flows.
A file transfer commonly benefits from TCP reliability. A real-time application may prefer UDP and handle timing, loss, or recovery in the application itself. Choosing TCP or UDP changes Transport layer behavior; it does not remove the Internet layer's basic role in routing IP packets.
Internet Layer
The Internet layer provides logical addressing and packet forwarding between networks. Its principal protocol is Internet Protocol (IP), including IPv4 and IPv6 versions.
IP addresses identify logical network locations. Routers examine destination IP addresses and use routing information to decide where to forward packets next. This enables communication across an internetwork made of multiple connected networks.
Logical delivery across networks differs from local delivery on a single link. IP determines the destination network and supports forwarding between networks. The Link layer handles the immediate transfer from one interface to the next interface. At a router, the received Link layer frame is removed, the IP packet is examined, and a new frame is created for the next link.
Link Layer
The Link layer covers the protocols and network-interface functions needed to send data across a local physical network. It is also called the Network Access layer.
Common Link layer responsibilities include:
- Creating and interpreting local frames.
- Using local-link addressing, such as Ethernet MAC addressing.
- Controlling access to a shared or point-to-point medium.
- Transmitting signals over the available physical medium.
Ethernet is a common local-area networking technology. Point-to-Point Protocol (PPP) is a Link layer protocol commonly used on point-to-point links. The TCP/IP Link layer combines responsibilities that the OSI model separates into the Data Link and Physical layers.
TCP/IP and OSI Model Comparison
The TCP/IP and OSI models are both layered conceptual frameworks, but their layer names and boundaries differ. The OSI model has seven layers, while the commonly taught TCP/IP model has four.
| TCP/IP layer | Corresponding OSI layer or layers | Key explanation |
|---|---|---|
| Application | Application, Presentation, Session | TCP/IP groups these upper-layer functions together. |
| Transport | Transport | Both models include an end-to-end transport layer. |
| Internet | Network | Both address logical delivery between networks. |
| Link | Data Link, Physical | TCP/IP groups local framing and physical-media functions together. |
The OSI model is useful for discussing precise functions and troubleshooting boundaries. The TCP/IP model is closely connected to the protocols deployed in IP networks. Neither model changes how bits, frames, packets, or application messages actually travel; each provides a different way to organize the same communication process.
For a deeper seven-layer comparison, see OSI Reference Model.
Protocol-to-Layer Mapping
| Protocol or technology | TCP/IP layer | Typical role |
|---|---|---|
| HTTP | Application | Web communication |
| SMTP | Application | Email submission or transfer |
| POP3 | Application | Email retrieval |
| TCP | Transport | Reliable, ordered process-to-process delivery |
| UDP | Transport | Low-overhead, best-effort process-to-process delivery |
| IP | Internet | Logical addressing and routing |
| Ethernet | Link | Local-area framing and transmission |
| PPP | Link | Point-to-point link communication |
These protocols cooperate across layers. HTTP does not independently deliver electrical signals, and Ethernet does not decide which web resource a user requested. Each protocol performs a particular task and relies on lower layers for additional services.
Encapsulation and Decapsulation
Encapsulation is the process of adding layer-specific control information as data moves down the protocol stack. Headers can contain information needed for ports, reliability, logical addressing, local delivery, or media transmission.
| Layer | Data unit commonly referenced | What is added or handled |
|---|---|---|
| Application | Data | Application protocol information |
| Transport | TCP segment or UDP datagram | Port and transport-control information |
| Internet | IP packet | Source and destination IP addressing |
| Link | Frame | Local-link addressing and media-specific framing |
Terminology can vary by context, but the common sequence is application data, a TCP segment or UDP datagram, an IP packet, and a Link layer frame.
- An application creates data, such as an HTTP request.
- TCP or UDP adds Transport layer information, including port information. The result is commonly called a segment for TCP or a datagram for UDP.
- IP adds logical source and destination addresses. The result is an IP packet.
- Ethernet or another Link technology adds local framing and sends the frame across the next link.
At the receiving host, decapsulation occurs. The Link layer processes and removes the frame information, the Internet layer processes the IP packet, the Transport layer delivers the payload to the correct process, and the Application layer passes the data to the appropriate application service.
Example: Loading a Web Page
Suppose a client loads a web page from a server on another network:
- The browser uses HTTP to form an application request.
- TCP may provide reliable, ordered delivery between the client and server processes.
- IP adds source and destination logical addresses and supports routing across networks.
- Ethernet carries the packet inside a frame across the client's local LAN.
- A router removes the incoming local frame, examines the IP packet, and forwards it in a new frame on the next link.
- The server decapsulates the data and passes the HTTP request to its web service.
The Link frame can change at every router hop because each link has its own local delivery requirements. The IP packet is forwarded toward its destination, while TCP maintains end-to-end transport behavior between the two hosts.
Example: Sending Email
When a mail client sends a message, SMTP operates at the Application layer. TCP commonly transports SMTP traffic, IP enables communication between the sender and the mail server across separate networks, and the local Link technology delivers each frame to the next hop. The receiving mail system may later provide the message to a client using a retrieval protocol such as POP3.
Using the Model for Troubleshooting
The model helps isolate a failure by asking which layer's responsibility is not working. A higher-layer service depends on lower-layer services, so a working local link does not prove that routing or an application is working.
Ethernet Works, but a Remote Server Is Unreachable
This points attention to the Internet layer. Check the host's IP address, subnet information, default gateway, and the routes toward the remote network. A functioning Ethernet connection proves local Link layer activity, not end-to-end IP reachability.
An IP Address Responds, but the Web Service Does Not Work
IP connectivity can function while the Application or Transport layer fails. Possible causes include an unavailable web service, a blocked or unused TCP port, DNS resolution problems, or an HTTP configuration issue.
UDP Data Is Missing or Out of Order
This is consistent with UDP's design. UDP does not inherently provide TCP-style acknowledgments, retransmissions, or ordered reliable delivery. If the application requires those features, it must implement them or use a protocol that provides them.
Local Traffic Works, but Traffic Fails After a Router
Separate Link and Internet layer checks. Local frames may be valid while the IP packet has an incorrect address, an invalid default gateway, or no usable route to the remote network. Frames are local to a link; they do not provide routing across the entire internetwork.
Exam- relevant Notes
- Remember the top-to-bottom order: Application, Transport, Internet, Link.
- Transport is also called the Host-to-Host layer.
- Link is also called the Network Access layer.
- TCP is connection-oriented and can provide reliable, ordered delivery.
- UDP is connectionless, best-effort, and lower overhead; reliability is not inherent.
- IP provides logical addressing and routing between networks.
- Ethernet and PPP operate at the TCP/IP Link layer.
- TCP/IP Application combines OSI Application, Presentation, and Session functions.
- TCP/IP Link combines OSI Data Link and Physical functions.
- At a router, the Link frame normally changes for the next hop, while the IP packet is forwarded toward its destination.
For related fundamentals, review Computer Network Expained, Unicast Multicast Broadcast Addresses, and Reliable Transport Protocol RTP.