VMware ESXi and vSphere Cluster Management

TCP/IP Reference Model: Layers, Protocols, and OSI Comparison

Learn the four TCP/IP reference model layers, their responsibilities and protocols, encapsulation, TCP versus UDP, and mapping to the OSI model.

The TCP/IP reference model is a four-layer framework for organizing the protocols used in network and internetwork communication. It helps explain how application data travels between hosts, across local networks, and through routers.

The model is especially useful when learning protocols such as HTTP, TCP, IP, and Ethernet. These protocols work together as a protocol stack; they are not isolated technologies.

Purpose and background of the TCP/IP model

The TCP/IP model originated from networking research sponsored by DARPA during the 1970s. Its design supported communication between different types of networks, computers, and vendors.

TCP/IP became an important foundation for modern internetworking because it is open, interoperable, and vendor-neutral. A vendor-neutral framework allows equipment and software from different manufacturers to communicate when they implement the same protocol standards.

A layered model divides communication responsibilities into manageable sections. This provides several benefits:

• Clear responsibilities: each layer focuses on a particular part of communication.
• Interoperability: common protocols and interfaces allow independent implementations to work together.
• Independent evolution: a protocol at one layer can change without requiring every other layer to be redesigned.
• Easier troubleshooting: a problem can be investigated according to the layer where it occurs.

Each layer provides services to the layer above it and relies on services from the layer below it. For example, an application protocol can use TCP without needing to implement packet routing or Ethernet framing itself.

The four TCP/IP layers

From top to bottom, the four layers are:

1. Application
2. Transport, also called the Host-to-Host layer
3. Internet
4. Link, also called the Network Access layer

Application layer

The Application layer supplies network services and communication rules used by application software. It supports application-to-application communication between endpoints.

This layer includes functions associated with the OSI Application, Presentation, and Session layers. TCP/IP groups those functions into one upper layer instead of defining them as three separate layers.

An application is not automatically a protocol. For example, a web browser is an application, while HTTP is a network protocol that the browser can use to request and receive web resources.

Representative Application-layer protocols

• HTTP: used for web communication between clients and web servers.
• SMTP: used to send email between mail systems.
• POP3: used by email clients to retrieve email from a mailbox.

Application-layer protocols define the structure and meaning of messages. They can depend on a Transport-layer protocol such as TCP or UDP to move those messages between processes.

Transport layer

The Transport layer, also called the Host-to-Host layer, provides end-to-end delivery between application processes on hosts. It divides application data into manageable units and supports delivery characteristics selected by the application.

Important Transport-layer functions include:

• Segmentation and reassembly: dividing data for transmission and putting it back together at the destination.
• Multiplexing: using port numbers to deliver received data to the correct application process.
• Service selection: choosing characteristics such as reliability, ordering, and overhead.

A port number identifies a Transport-layer endpoint associated with an application process. IP addressing can identify a host, while a port helps identify the service or process on that host.

TCP

TCP is connection-oriented and provides reliable, ordered byte-stream delivery. Before transferring application data, TCP establishes a connection between the endpoints.

TCP reliability uses mechanisms such as:

• Sequence numbers to track the order of data.
• Acknowledgments to confirm received data.
• Retransmission when data is believed to be lost.
• Flow control to help prevent a sender from overwhelming a receiver.

TCP is useful when an application requires ordered and reliable delivery, such as many web, email, and file-transfer operations.

UDP

UDP is connectionless and has low overhead. It does not provide TCP-style guarantees for delivery, ordering, or retransmission.

UDP can be suitable when low delay or simple message delivery is more important than built-in reliability. An application using UDP may tolerate loss, provide its own recovery mechanisms, or use the protocol for short exchanges.

Internet layer

The Internet layer provides logical addressing and routing of IP packets between separate networks. Its primary protocol is IP.

IP adds source and destination IP addresses to data and carries packets from a source host toward a destination host. Routers examine IP information and forward packets toward other networks until the packets reach the destination network.

IP is generally a best-effort service. IP does not by itself guarantee that a packet will arrive, arrive only once, arrive in order, or be recovered after an error. Reliability and recovery, when needed, may be supplied by TCP or by an application.

A packet is a commonly used name for an Internet-layer IP data unit. The Internet layer can route that packet across many networks, unlike the Link layer, which delivers data over one local link at a time.

Link layer

The Link layer, also called the Network Access layer, handles delivery across a directly connected network medium. It combines functions comparable to the OSI Data Link and Physical layers.

Link-layer responsibilities include:

• Using network interface hardware.
• Creating and processing local-link frames.
• Handling local delivery information and media access.
• Representing data for transmission over a physical medium.

Ethernet is a common Link-layer technology for local-area networks. PPP is a Link-layer protocol used for point-to-point connections.

Link-layer delivery is hop-by-hop. A frame carries data across one local link to the next device, such as a router. When a router forwards the IP packet, it normally removes the old frame and creates a new frame for the next link. Internet-layer routing, in contrast, can span many interconnected networks.

TCP/IP and OSI model comparison

The OSI reference model has seven layers, while the TCP/IP reference model commonly has four. Both are conceptual frameworks for understanding network communication, not physical objects that every protocol must follow identically.

Protocol placement can occasionally be discussed differently depending on the teaching context. The mapping above is the standard conceptual comparison used for introductory networking. The important idea is that TCP/IP combines some OSI functions rather than representing them as separate layers.

Common protocols by TCP/IP layer

Layered communication and encapsulation

Encapsulation is the addition of layer-specific headers or other control information as data moves downward through the sending host's protocol stack.

1. The application creates application data, such as an HTTP request.
2. The Transport layer adds TCP or UDP information, including source and destination port numbers. The result is commonly called a TCP segment or a UDP datagram.
3. The Internet layer adds source and destination IP addresses. The result is an IP packet.
4. The Link layer places the packet into a local-link frame and adds information needed for delivery across the local medium.

At the receiving host, decapsulation occurs in reverse order. The Link layer processes and removes the frame information, the Internet layer processes the IP header, the Transport layer uses the port and transport information, and the Application layer delivers the remaining data to the target application.

Opening a web page

• HTTP creates a web request at the Application layer.
• TCP provides transport communication between the client and web server, using port numbers.
• IP supplies addresses and routes the packet toward the server's network.
• Ethernet or another Link-layer technology sends a frame across each local network hop.

The HTTP request therefore depends on several protocols working as a stack. HTTP does not perform routing, and Ethernet does not decide the complete path across the internetwork.

Sending email

• SMTP provides the application-level email transfer service.
• TCP can provide reliable transport for the SMTP session.
• IP carries the traffic between networks.
• A local Link-layer technology such as Ethernet delivers the traffic to the next device.

TCP compared with UDP

A web transaction can use TCP when ordered and reliable delivery is required. A latency-sensitive application may use UDP when lower overhead is preferred and the application can tolerate loss or handle recovery itself.

Using the model for troubleshooting

The layered model helps narrow down a fault by separating local connectivity, routing, transport services, and application behavior.

Local devices work, but a remote network cannot be reached

Local communication may show that the Link layer is functioning. Investigate Internet-layer issues such as IP addressing, the default gateway, routing, or a failure somewhere along the remote path.

A server responds by IP address, but the desired service fails

Basic Internet-layer reachability may exist while the problem is at the Transport or Application layer. Possible causes include a blocked port, a TCP/UDP mismatch, a stopped service, or an application protocol problem.

Confusing Ethernet with IP

Ethernet can carry IP traffic, but that does not make Ethernet an Internet-layer protocol. Ethernet provides Link-layer framing and local delivery; IP provides logical addressing and routing across networks.

Assuming all TCP/IP delivery is reliable

Reliability is a service supplied by TCP. UDP does not provide TCP-style reliability, and IP provides best-effort forwarding. Always identify which protocol supplies the behavior being discussed.

Key points to remember

• The TCP/IP reference model has four layers: Application, Transport, Internet, and Link.
• The Transport layer is also called Host-to-Host, and the Link layer is also called Network Access.
• Application protocols provide network services to software; applications themselves are not necessarily protocols.
• TCP is connection-oriented and reliable; UDP is connectionless and lightweight.
• IP provides logical addressing and routing, but it is best-effort.
• Ethernet and PPP provide Link-layer functions for local or point-to-point delivery.
• Encapsulation adds control information as data moves down the stack; decapsulation removes and processes it as data moves up.
• Protocols operate together as a stack, with each layer serving the layer above and using the layer below.

For a related reference, see the TCP/IP reference model guide.