VMware ESXi and vSphere Cluster Management
TCP/IP Protocol Suite: Layers, Protocols, and Network Communication
Learn how the TCP/IP protocol suite works, including its four layers, encapsulation, ARP, IP, ICMP, TCP, UDP, DNS, HTTP, FTP, and Telnet.
The TCP/IP protocol suite is a family of interoperable network protocols used to exchange data between computers, phones, servers, routers, and other networked devices. It is the foundation of the Internet and is also widely used on private local networks.
TCP/IP is not just TCP and IP. It includes protocols for applications, transport between processes, logical addressing, routing, local-link delivery, diagnostics, and name resolution. Together, these protocols prepare data, identify endpoints, move packets across networks, deliver information to the correct application, and help the receiving application interpret the data.
The suite is named after two of its most important protocols: Transmission Control Protocol (TCP) and Internet Protocol (IP). TCP provides reliable transport when an application needs ordered, complete delivery. IP provides logical addressing and best-effort forwarding between networks.
The TCP/IP Four-Layer Model
The TCP/IP model organizes network functions into four layers. Each layer has a distinct responsibility and uses services supplied by the layer below it. This abstraction lets application developers use networking without managing Ethernet signals, and lets network hardware forward traffic without understanding the contents of a web request.
The TCP/IP model is commonly compared with the seven-layer OSI reference model, but the two models are not identical. TCP/IP combines some functions that OSI describes separately. For example, TCP/IP's Application layer generally covers functions associated with the OSI application, presentation, and session layers.
Encapsulation and Decapsulation
Encapsulation is the process of adding layer-specific information as data moves down the sender's protocol stack. An application creates data, the transport layer adds a TCP or UDP header, IP adds an IP header, and the Network Access layer places the result inside a link-layer frame.
Decapsulation is the reverse process. The receiver processes and removes the frame information, examines the IP packet, delivers the TCP segment or UDP datagram to the correct port, and passes the application data to the appropriate program.
Application data
-> TCP segment or UDP datagram
-> IP packet
-> Ethernet or Wi-Fi frameNetwork Access Layer
The Network Access layer handles delivery across one local network link. Ethernet frames travel through wired switches and cables, while Wi-Fi frames travel through wireless radio links and access points. This layer also deals with local media access and the format of frames.
A MAC address is a link-layer identifier used to deliver a frame on the local network segment. It is not a globally routed Internet identifier. A router removes the incoming link-layer frame and creates a new frame for the next link.
ARP and Local IPv4 Delivery
Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on the local network. A host may broadcast an ARP request asking which device owns a particular IPv4 address. The owner replies with its MAC address, and the result is commonly stored in an ARP cache.
ARP operates only within a local IPv4 broadcast domain. Routers do not forward ARP broadcasts, so a host does not use ARP to discover the MAC address of a remote server across the Internet.
When the destination is on another subnet, the sender keeps the remote server's IP address in the IP packet but sends the first local frame to the MAC address of its default gateway. ARP therefore resolves the IP address of the local next hop, usually the router, not the remote destination.
Internet Layer
Internet Protocol (IP) supplies logical addressing and moves packets between interconnected networks. An IP packet contains source and destination IP addresses. Routers examine the destination IP address and their routing information to select a next hop.
IP provides best-effort delivery. By itself, it does not guarantee that a packet will arrive, arrive only once, arrive in order, or be retransmitted after loss. Reliability, when required, is usually provided by TCP or by the application.
IP addresses and MAC addresses have different roles. An IP address identifies a logical network endpoint for routing across networks. A MAC address identifies the local-link destination for the current frame. On a multi-hop path, the destination IP usually remains the same end to end, while the frame's source and destination MAC addresses change at every link.
ICMP and Ping
Internet Control Message Protocol (ICMP) supports IP by carrying error reports, status information, and diagnostic messages. It can report conditions such as an unreachable destination or an expired packet lifetime.
The ping utility commonly sends an ICMP Echo Request and waits for an ICMP Echo Reply. A reply can demonstrate that a path and a responding host are reachable, but it does not prove that a particular TCP or UDP service is available. Ping may fail because of routing problems, filtering, host failure, or an intentional ICMP policy.
Transport Layer
The Transport layer delivers data between processes, not merely between hosts. A host can run many network applications at once, so transport protocols use port numbers to identify services and application endpoints.
An endpoint can be described using an IP address, transport protocol, and port number. For example, a TCP service might be identified by 192.0.2.10, TCP, and port 80. A complete conversation also distinguishes the remote endpoint and uses source and destination port numbers.
TCP and UDP
TCP is connection-oriented and reliable. Its three-way handshake synchronizes the two endpoints and confirms that both can send and receive before application data is normally exchanged. TCP then uses sequence numbers, acknowledgments, retransmission, and flow control to provide ordered delivery.
UDP is connectionless and best effort. It has no built-in handshake, retransmission, ordering, or delivery guarantee. An application chooses UDP when its requirements favor low overhead, timely delivery, multicast or broadcast behavior, or application-managed recovery.
Application Layer Protocols
Application-layer protocols define rules for a specific network function. They specify message formats, requests and responses, command meanings, and how a client and service exchange information.
Addressing Concepts and Scope
A MAC address does not identify a device across the entire Internet. Likewise, ARP does not resolve the remote server's MAC address when traffic crosses routers. ARP resolves the MAC address needed for the next local link.
What Happens When You Open a Website?
- Name resolution: You enter a hostname such as
www.example.com. DNS resolves the name to one or more IP addresses. - Local route decision: Your host compares the destination IP with its own subnet information. If the destination is local, it sends directly to that host. If it is remote, it selects the default gateway as the next hop.
- ARP resolution: The host checks its neighbor or ARP cache. If necessary, it uses ARP to discover the MAC address of the local destination or default gateway.
- TCP connection: The client connects to the web service's TCP port, commonly port 80 for HTTP. TCP performs its three-way handshake.
- HTTP exchange: The browser sends an HTTP request, and the server returns web resources such as HTML, stylesheets, scripts, and media.
- Routing: IP packets cross routers. At each hop, the router forwards the packet and creates a new Ethernet or Wi-Fi frame for the next local link.
- Delivery to the application: The receiving host decapsulates the frame, processes the IP packet, uses the destination TCP port to select the web service, and delivers the HTTP data to that application.
DNS name -> destination IP
local next hop -> destination MAC through ARP
TCP handshake -> reliable transport connection
HTTP request/response -> application data
IP packet -> routed across networks
new frame at each link -> local deliveryPractical Commands
These commands help separate name resolution, local neighbor discovery, reachability, and routed-path questions. Results vary by operating system, network configuration, and filtering policy.
ping example.com
nslookup example.com
dig example.com
arp -a
ip neigh show
traceroute example.com
tracert example.comping example.comtests hostname resolution and commonly uses ICMP echo messages.nslookup example.cominspects DNS name-to-address resolution.dig example.comprovides more detailed DNS queries where available.arp -adisplays cached IPv4-to-MAC mappings on supported systems.ip neigh showdisplays neighbor-resolution entries on modern Linux systems.tracerouteon Unix-like systems andtracerton Windows can illustrate the path toward an IP destination.
Troubleshooting with the Layers
A hostname fails, but the IP address is known
Separate DNS from IP connectivity. Use nslookup or dig to check whether the name resolves and whether the returned record is appropriate. Test the IP directly where that test is meaningful.
Two devices on the same IPv4 LAN cannot communicate
Verify their IP addresses and subnet membership. Inspect arp -a or ip neigh show. Also check cable or Wi-Fi connectivity, VLAN placement, duplicate IP addresses, host firewalls, and switch configuration.
A host responds to ping, but a website does not load
ICMP reachability is different from application availability. Check whether the required TCP port is reachable, whether the web server is running, whether firewall rules permit the traffic, and whether the HTTP exchange returns an error.
A UDP application loses data intermittently
UDP has no native delivery, ordering, or retransmission guarantee. Investigate packet loss, congestion, wireless quality, application retry behavior, and whether the application needs its own sequencing or recovery mechanism.
Remote traffic uses the gateway's MAC address
This is expected. The IP packet can retain the remote server as its destination while the first Ethernet frame targets the default gateway's MAC address. Each router repeats this process with a new frame on the next link.
Exam-Relevant Points
- TCP/IP is a protocol family, not only two protocols.
- The four layers are Application, Transport, Internet, and Network Access.
- Encapsulation occurs while sending data down the stack; decapsulation occurs while receiving data up the stack.
- TCP uses connections, sequencing, acknowledgments, retransmission, and flow control. UDP does not provide these guarantees by default.
- IP routes packets between networks but is best effort.
- ARP maps an IPv4 address to a MAC address only on the local broadcast domain.
- Routers make forwarding decisions using destination IP addresses, not remote MAC addresses.
- Ping commonly tests ICMP reachability, not the availability of a specific application service.
- DNS maps names to address information, while ports identify services on a host.