Network Protocols HTTP, TCP, UDP, DNS, DHCP

Application Layer Protocols

A protocol defines the messages, order, fields, and error behavior that communicating systems agree to use.

Layering separates local delivery, routed delivery, transport behavior, and application meaning so each problem can be tested at the correct boundary.

Port numbers are defaults for service discovery, not proof that a particular application or security policy is in use.

Application protocols define the meaning and exchange pattern seen by software: requests and responses, mail transfer, name lookup, address configuration, time synchronization, or remote administration. The application protocol is carried by a transport, commonly TCP, UDP, or QUIC. TLS adds authentication, integrity, and encryption but does not by itself define the application message.

A well-known port is a conventional listening endpoint. Services can run on different ports, and the same port number can carry unexpected traffic. Troubleshooting should verify the protocol exchange, certificate or authentication state, and response, not stop after a TCP connection succeeds.

Protocol	Port	Transport	Purpose
HTTP	80	TCP	Web browsing (HyperText Transfer Protocol)
HTTPS	443	TCP	Secure web browsing (HTTP over TLS/SSL)
FTP	20 (data), 21 (control)	TCP	File Transfer Protocol
SFTP	22	TCP	Secure File Transfer (over SSH)
SSH	22	TCP	Secure Shell - encrypted remote access
Telnet	23	TCP	Remote access (unencrypted - avoid!)
SMTP	25, 587	TCP	Simple Mail Transfer Protocol - sending email
POP3	110, 995 (SSL)	TCP	Post Office Protocol - receiving email (downloads)
IMAP	143, 993 (SSL)	TCP	Internet Message Access Protocol - receiving email (syncs)
DNS	53	UDP/TCP	Domain Name System - name resolution
DHCP	67 (server), 68 (client)	UDP	Dynamic Host Configuration Protocol - IP assignment
SNMP	161, 162	UDP	Simple Network Management Protocol - network monitoring
NTP	123	UDP	Network Time Protocol - time synchronization
LDAP	389, 636 (SSL)	TCP	Lightweight Directory Access Protocol - directory services
RDP	3389	TCP	Remote Desktop Protocol - Windows remote desktop

HTTP commonly uses TCP; HTTP/3 uses QUIC over UDP.
DNS usually uses UDP or TCP on port 53, while encrypted DNS may use HTTPS or TLS transports.
DHCP uses broadcasts during initial IPv4 configuration because the client does not yet have a usable address.
SFTP is the SSH File Transfer Protocol and is not FTP protected by TLS.

Transport Layer Protocols

TCP provides an ordered byte stream with acknowledgements, retransmission, flow control, and congestion control. It does not preserve application message boundaries, so an application must frame messages by length, delimiter, or protocol syntax. A successful TCP handshake proves endpoint reachability, not that the application request is valid.

UDP sends independent datagrams without connection setup, guaranteed delivery, or ordering. Applications choose it when timeliness, multicast, a small request-response exchange, or an application-level reliability design matters more than a built-in stream. QUIC builds secure multiplexed connections and reliability over UDP rather than using raw UDP semantics directly.

Protocol	Description	Key Features
TCP	Transmission Control Protocol	Connection-oriented, reliable, ordered, flow control, congestion control
UDP	User Datagram Protocol	Connectionless, unreliable, fast, low overhead, no flow control
SCTP	Stream Control Transmission Protocol	Multi-streaming, multi-homing, combines TCP reliability with UDP features

Choose transport from loss, ordering, latency, fan-out, and implementation requirements.
Do not call UDP inherently faster; its smaller transport contract shifts work and tradeoffs to the application.
Size datagrams to avoid IP fragmentation across the expected path.
Use captures and socket statistics to distinguish retransmission, reset, timeout, and application delay.

Network Layer Protocols

IP provides logical addressing and routed packet delivery between networks. Routers inspect the destination prefix and choose a next hop; they do not guarantee that a packet arrives, arrives once, or arrives in order. IPv4 and IPv6 have different address formats and neighbor-discovery behavior but serve the same routed-delivery role.

ICMP carries diagnostics and control information such as unreachable and packet-too-big messages. Blocking all ICMP can break path MTU discovery and hide useful failure evidence. OSPF and BGP exchange reachability between routers: OSPF is commonly used inside one administrative domain, while BGP carries policy-driven routes between autonomous systems.

Protocol	Purpose
IPv4 / IPv6	Logical addressing, packet delivery, and routing between networks
ICMP / ICMPv6	Errors, diagnostics, and essential control messages
OSPF	Link-state interior routing within an administrative domain
BGP	Policy-based reachability exchange between autonomous systems
IGMP / MLD	IPv4 or IPv6 multicast listener membership

ARP resolves an IPv4 next-hop address to a link-layer address on the local network; IPv6 uses Neighbor Discovery.
A host sends off-subnet traffic to its default gateway after applying its prefix length.
TTL in IPv4 and Hop Limit in IPv6 prevents packets from circulating forever.
NAT changes addressing at a boundary but is separate from routing and firewall policy.

Data Link Layer Protocols

The data-link layer moves frames across one local link. Ethernet switches learn source MAC addresses and forward frames within a broadcast domain. Modern switched full-duplex Ethernet does not use collision detection during normal operation; the historical CSMA/CD behavior applies to shared half-duplex Ethernet.

Wi-Fi coordinates access to a radio channel and adds association, authentication, and retransmission behavior specific to wireless links. Signal quality, interference, channel width, client capability, and access-point load all affect a wireless path. VLAN tags create logical link-layer segments, while a router is required for traffic between IP subnets.

Protocol	Standard	Description
Ethernet	IEEE 802.3	Wired LAN framing and media standards; switched full-duplex operation is typical
Wi-Fi	IEEE 802.11	Wireless LAN family, including current Wi-Fi generations supported by the endpoints
802.1Q VLAN	IEEE 802.1Q	Tags frames to separate logical broadcast domains on shared links
PPP	RFC 1661	Encapsulation and negotiation for point-to-point links
Frame Relay / ATM	Legacy WAN	Legacy WAN technologies encountered in existing infrastructure, not modern LAN defaults

MAC addresses identify interfaces on a link; routers rewrite link-layer headers at each routed hop.
A switch forwards frames inside a VLAN, while a router forwards packets between IP networks.
PPP remains relevant on point-to-point links; Frame Relay and ATM are primarily legacy study topics.
Capture on the correct interface and VLAN before concluding that a frame never existed.

Follow One Request Across the Layers

When a browser opens an HTTPS URL, DNS first maps the host name to an address unless a usable answer is cached. The host decides whether that address is local; for a remote destination it resolves the default gateway on the local link. Routers forward IP packets toward the destination. TCP plus TLS, or QUIC for HTTP/3, establishes protected application transport before HTTP exchanges a request and response.

Each layer has different evidence. DNS tools show names and records. The route table and neighbor cache show local forwarding decisions. ping and traceroute offer partial IP-path evidence. A socket test shows transport reachability. TLS inspection shows certificate and handshake state. An HTTP client finally shows status, headers, and body. Testing in that order keeps one failure from being mislabeled as another.

Start with the exact name, address family, protocol, port, and client network that failed.
Compare a working and failing path at the same layer and timestamp.
Remember that firewalls, proxies, load balancers, and NAT may change the visible path.
Stop only when the intended application transaction succeeds, not when one intermediate probe responds.

Select Transport Behavior for Three Applications

File upload: TCP because every ordered byte must arrive.
Live voice: UDP with application-level loss handling because late audio is not useful.
DNS lookup: usually UDP for a small query, with TCP available for responses or operations that require it.

Protocol choice follows delivery, ordering, latency, and recovery requirements.

Follow an Email Submission Protocol Chain

Client -> DNS MX lookup
Client -> submission service with SMTP over authenticated TLS
Submission service -> recipient mail exchanger with SMTP
Recipient client -> mailbox using IMAP or a web API

One user action can involve several protocols with separate trust and failure boundaries.

Before you move on