VMware ESXi and vSphere Cluster Management

TCP/IP Suite of Protocols

Learn how the TCP/IP suite enables network communication through its four-layer model, including DNS, HTTP, TCP, UDP, IP, ICMP, ARP, FTP, and Telnet.

What Is the TCP/IP Suite?

The TCP/IP suite is a family of interoperating communication protocols used by modern computer networks and the Internet. A protocol is an agreed set of rules for formatting, sending, receiving, and interpreting data.

The suite defines end-to-end communication: an application prepares data, the sender addresses it, network devices forward it, the receiver accepts it, and the destination application receives the result. Different protocols perform different parts of this process rather than one protocol performing every task.

The name comes from two foundational protocols: Transmission Control Protocol (TCP), which provides reliable transport services, and Internet Protocol (IP), which provides logical addressing and packet forwarding between networks. The suite also includes protocols for naming, diagnostics, local delivery, web communication, file transfer, and remote terminal access.

In this lesson, the phrase TCP/IP model refers to a four-layer conceptual model. It groups protocols according to the network function they perform.

The TCP/IP Four-Layer Model

The four layers are the Application, Transport, Internet, and Network Access layers. A layer offers services to the layer above it and uses services from the layer below it.

How Data Moves Through the Layers

At the sender, application data moves downward through the stack. The transport layer adds transport information, the Internet layer adds an IP header, and the Network Access layer places the packet inside a local-link frame.

This process is called encapsulation: each layer adds protocol information needed for its function. At the receiver, the reverse process is called decapsulation. Each layer interprets and removes its relevant information before passing the remaining data upward to the destination application.

1. An application creates a request or response.
2. TCP or UDP identifies the communicating application processes and supplies transport services.
3. IP adds source and destination logical addresses and supports routing.
4. The Network Access layer creates a frame for the next local link.
5. The receiving host decapsulates the frame, packet, and transport data until the application receives its message.

A packet is a unit of data associated with IP-layer delivery. A frame is a local-network unit that carries a packet across one link. The packet can travel across several links, while a new frame is normally created for each link.

Application Layer Protocols

The Application layer supplies network-oriented services directly to software. An application protocol defines how software communicates; it is not necessarily the same thing as the application that uses it. For example, a web browser is an application that commonly uses HTTP, while HTTP is the protocol defining web requests and responses.

DNS

Domain Name System (DNS) translates hostnames and domain names into IP addresses. People can use names such as a website hostname, while network communication ultimately uses IP addresses. DNS can also provide other record data, but name-to-address resolution is its foundational role.

HTTP

Hypertext Transfer Protocol (HTTP) defines web communication. A client sends an HTTP request for a resource, such as an HTML document, image, or API response, and a server returns an HTTP response. HTTP commonly uses TCP for reliable delivery; modern web deployments can also use HTTP over newer transport arrangements such as HTTP/3 over UDP-based QUIC.

FTP

File Transfer Protocol (FTP) supports transferring files between hosts. It provides operations such as listing directories, uploading files, and downloading files. Traditional FTP does not provide the security expected of modern encrypted administration or file-transfer solutions unless protected by an additional mechanism.

Telnet

Telnet is a remote terminal protocol. It transmits terminal data, including credentials, without encryption. Anyone able to observe the traffic may be able to read it, so Telnet is generally unsuitable for secure administration. SSH is the usual secure alternative, although SSH is a separate protocol.

Transport Layer Protocols

The Transport layer provides communication between application processes on different hosts. It uses port numbers to distinguish services and gives applications a choice of delivery behavior.

TCP: Reliable, Connection-Oriented Transport

Transmission Control Protocol (TCP) is connection-oriented. Before normal data exchange, TCP establishes a transport conversation. It provides reliable and ordered delivery by using acknowledgments, sequence numbers, retransmission of missing data, and flow and congestion controls.

TCP reliability does not mean that the network itself guarantees delivery. Instead, TCP detects problems and works to recover from loss or reordering between the two endpoints. This adds processing, state, and header overhead.

UDP: Lightweight, Connectionless Transport

User Datagram Protocol (UDP) is connectionless. It sends independent datagrams without first establishing a TCP-style session. UDP provides low overhead but does not itself guarantee delivery, ordering, duplicate suppression, or retransmission.

UDP is useful when low overhead or timely delivery matters and the application can tolerate loss or implement its own controls. Many real-time media systems and query-response services use UDP. The choice is determined by application requirements, not by a blanket rule that UDP is always faster.

Internet Layer Protocols

IP

Internet Protocol (IP) provides logical addressing and forwards packets from a source toward a destination across interconnected networks. Routers examine the destination IP address and select a next hop according to their routing information.

IP is best-effort. It attempts to forward packets but does not itself promise arrival, ordering, duplicate prevention, or recovery from loss. TCP can provide reliability above IP, while UDP intentionally provides a simpler service above IP.

ICMP and Ping

Internet Control Message Protocol (ICMP) communicates IP-related errors and diagnostic information. The ping utility commonly sends an ICMP Echo Request and looks for an ICMP Echo Reply. A reply demonstrates that the tested path and host responded to ICMP, but it does not prove that every application service or port is available.

Network Access Layer and Addressing

The Network Access layer covers local-network delivery, framing, media access, and transmission over a physical or wireless link. Ethernet is a common example of a local-link technology.

IP Addresses and MAC Addresses

An IP address is a logical address used to identify an interface or host and route toward it. A MAC address is a link-layer address used to deliver a frame on the local network. IP addresses support communication across routed networks; MAC addresses are relevant to the current local link.

ARP

Address Resolution Protocol (ARP) associates an IPv4 address with a MAC address on a local network. A host can broadcast an ARP request asking which local device owns an IPv4 address. The owner responds with its MAC address, and the result may be cached in an ARP table.

ARP does not discover the remote server's MAC address across routers. If the destination is on another network, the sender resolves the MAC address of its local default gateway instead. The IP packet still has the remote server's IP address, while the local frame has the gateway's MAC address as its destination.

In this lesson, ARP is grouped with the Network Access layer because its immediate function supports local-link delivery. Some standards references and teaching materials place ARP near the boundary between the Internet and Network Access layers. The important distinction is its function: IPv4-to-MAC resolution for a local link.

Protocol-to-Layer Reference

Example: Opening a Website by Name

1. A user enters a website name in a browser. The browser or operating system requests DNS resolution.
2. DNS returns an IP address for the web server. The client now knows the logical destination, but it still needs to deliver traffic across its local link.
3. The browser selects an appropriate web transport. A typical HTTP exchange uses TCP, while some modern web exchanges use a UDP-based transport such as QUIC.
4. The client creates application data, such as an HTTP request. The transport layer adds its information, and IP adds the source and remote destination IP addresses.
5. If the server is remote, the client determines that the first hop is its default gateway. ARP learns the gateway's local MAC address if that mapping is not already cached.
6. The Network Access layer places the IP packet in a local frame addressed to the gateway's MAC address and transmits it.
7. The router removes the local frame, examines the destination IP address, and forwards the packet. At each routed link, local frame addressing can change while the packet continues toward the remote IP destination.
8. The server decapsulates the received data and delivers the request to its web service. The response travels back through the same layered process in reverse.

Each protocol has a specific role: DNS supplies an address, TCP or UDP supplies transport behavior, HTTP defines web messages, IP supports routed delivery, ARP identifies the local next hop, and the link technology transmits frames.

Example: Pinging a Host

When you run ping <destination-name-or-ip>, the system may first use DNS if a name was supplied. IP addresses the traffic, ARP may identify the local next-hop MAC address, and ICMP carries the Echo Request and Echo Reply messages.

A successful ping indicates that the destination or an intermediate system responded to ICMP and provides a round-trip time. It does not prove that DNS, a web server, a TCP port, a UDP service, or an application protocol is working.

Useful Diagnostic Commands

ping <destination-name-or-ip>
nslookup <hostname>
tracert <destination-name-or-ip>        Windows
traceroute <destination-name-or-ip>     Linux and Unix-like systems
ipconfig /all                            Windows
ip addr                                  Linux
ip neigh                                 Linux
arp -a

• nslookup tests DNS resolution and displays returned addresses.
• ipconfig /all displays Windows interface addresses, MAC information, DNS servers, and the default gateway.
• ip addr displays Linux interface IP and link-layer addresses.
• ip neigh displays Linux neighbor entries, including ARP-derived IPv4 mappings.
• arp -a displays cached IPv4-to-MAC mappings where supported.
• tracert or traceroute helps illustrate the routed hops between a source and destination.

Troubleshooting by Layer

Name Fails, IP Address Works

If a hostname does not open but entering an IP address works, suspect DNS. Run nslookup <hostname>, verify the configured DNS server, and compare the result with a known reachable address.

Default Gateway Is Unreachable

Check the host IP address, subnet mask or prefix length, and default gateway. Then ping the gateway, inspect the ARP or neighbor table, verify the interface is up, and check local switching or VLAN membership. This symptom can involve physical connectivity, local addressing, or ARP.

Ping Works but an Application Does Not

ICMP reachability is not proof that an application service is available. Confirm DNS, verify that the service is listening, check the relevant TCP or UDP port, and review firewall or security policy.

Intermittent Access or Incomplete Transfers

Possible causes include packet loss, path instability, transport behavior, application errors, or service-side problems. Compare the service's TCP or UDP behavior, use ping and traceroute, inspect interface statistics and firewall rules, and review service logs.

Key Points to Remember

• The TCP/IP suite is a cooperating family of protocols for communication across interconnected networks.
• The four layers are Application, Transport, Internet, and Network Access.
• Encapsulation adds layer-specific information on the way down; decapsulation interprets and removes it on the way up.
• DNS resolves names, HTTP handles web messages, FTP transfers files, and Telnet provides insecure remote terminal access.
• TCP is connection-oriented, reliable, and ordered; UDP is connectionless, lightweight, and best-effort.
• IP provides logical addressing and routing but does not guarantee delivery.
• ICMP supports IP error reporting and diagnostics such as ping.
• ARP maps an IPv4 address to a local MAC address; it does not resolve a remote host's MAC address across routers.