A sender adds control information as data moves down the stack. The receiver removes it in reverse order.
Application DataHTTP, DNS, SMTP, or another application protocol
Transport SegmentTCP or UDP adds ports and delivery semantics
Internet PacketIP adds source and destination addresses
Link FrameEthernet or Wi-Fi carries one local-hop frame
Physical SignalBits travel over copper, fiber, or radio
What is the TCP/IP Model?
The TCP/IP model (also called the Internet model or DoD model) is the practical networking model used by the Internet. It was developed by DARPA in the 1970s. Unlike the OSI model (theoretical), TCP/IP is the actual implementation used in real networks.
The TCP/IP model has 4 layers (some sources say 5):
Before data transfer, TCP establishes a connection using a 3-way handshake:
After the handshake, data transfer begins. The connection is full-duplex - both sides can send and receive simultaneously.
SYN (Synchronize): Client sends a SYN packet to the server with a random sequence number (ISN). "I want to connect, my sequence number is X."
SYN-ACK (Synchronize-Acknowledge): Server responds with SYN-ACK. Acknowledges client's SYN (ACK = X+1) and sends its own SYN with sequence number Y. "I acknowledge your X, my sequence number is Y."
ACK (Acknowledge): Client sends ACK (ACK = Y+1). "I acknowledge your Y. Connection established."
TCP Connection Termination (4-Way Handshake)
TCP uses a 4-way handshake to close a connection:
After the final ACK, the client waits in TIME_WAIT state (2×MSL) before fully closing, to ensure the server received the final ACK.
FIN: Client sends FIN to server. "I'm done sending data."
ACK: Server acknowledges the FIN. "Got it."
FIN: Server sends its own FIN. "I'm also done sending data."
ACK: Client acknowledges server's FIN. "Got it. Connection closed."
The Application layer is where user applications interact with the network. It combines the functionality of OSI's Application, Presentation, and Session layers. This layer provides protocols for specific applications and services.
The Transport layer provides end-to-end communication services between applications running on different hosts. It ensures reliable data delivery and manages multiple simultaneous connections.
The Internet layer is responsible for logical addressing, routing, and packet forwarding across different networks. It handles the movement of packets across multiple networks.
The Network Access layer (also called Link layer) handles the physical transmission of data over the network medium. It combines OSI's Data Link and Physical layers.
HTTP/HTTPS: Web browsing and secure web communication
FTP/SFTP: File transfer and secure file transfer
SMTP/POP3/IMAP: Email sending and receiving
DNS: Domain name resolution
DHCP: Dynamic IP address assignment
SSH/Telnet: Remote command-line access
SNMP: Network management and monitoring
TCP (Transmission Control Protocol): Connection-oriented, reliable delivery
UDP (User Datagram Protocol): Connectionless, fast delivery
SCTP (Stream Control Transmission Protocol): Reliable multi-streaming
DCCP (Datagram Congestion Control Protocol): Congestion control without reliability
IPv4/IPv6: Logical addressing and packet routing
ICMP: Error reporting and diagnostics (ping, traceroute)
ARP: Address resolution (IP to MAC address mapping)
RARP: Reverse address resolution (MAC to IP)
Routing Protocols: OSPF, BGP, RIP for route determination
Ethernet: Most common LAN technology
Wi-Fi (802.11): Wireless LAN technology
PPP: Point-to-Point Protocol for dial-up connections
Frame Relay: Wide area network technology
ATM: Asynchronous Transfer Mode
TCP Flow Control and Congestion Control
TCP uses a sliding window to control the amount of data that can be sent before acknowledgment is required. This prevents the sender from overwhelming the receiver.
Window Size: Amount of unacknowledged data that can be sent
Dynamic Adjustment: Window size changes based on network conditions
Flow Control: Receiver advertises available buffer space
Congestion Control: Sender reduces transmission rate when congestion detected
QUIC (Quick UDP Internet Connections): UDP-based transport for web
HTTP/3: HTTP over QUIC instead of TCP
Segment Routing: Advanced routing techniques
Programmable Networking: SDN and network automation
5G and Beyond: Ultra-low latency, massive connectivity
TCP/IP packet-flow walkthrough
TCP/IP packet-flow walkthrough
Client device
-> local network interface
-> default gateway or switch
-> routing/security decision
-> destination service
For TCP/IP, explain each hop by naming the address, protocol, port, and decision made at that layer.
Map a DNS Query to the Four TCP/IP Layers
Map a DNS Query to the Four TCP/IP Layers
Application: DNS query for api.example
Transport: UDP source port 53000 to destination port 53
Internet: IPv4 packet to the recursive resolver
Link: Wi-Fi frame sent to the local access point
Return path: each layer removes its header and delivers the DNS answer upward
The TCP/IP model groups practical protocol responsibilities into application, transport, internet, and link layers.
Before you move on
TCP/IP Model 4 Layers 3 Way Handshake Mastery Check
4 checks
The TCP/IP model (also called the Internet model or DoD model) is the practical networking model used by the Internet.
It was developed by DARPA in the 1970s.
Unlike the OSI model (theoretical), TCP/IP is the actual implementation used in real networks.
Map one browser request through application, transport, internet, and link responsibilities.
The handshake confirms that both endpoints can send and receive and establishes initial sequence numbers for reliable delivery.
UDP fits workloads that value low overhead, tolerate some loss, or implement reliability themselves: DNS queries, voice, video, gaming, and modern transports such as QUIC.
The handshake can complete even when the application is stalled, waiting on another dependency, blocked by flow control, or speaking the wrong protocol. A connected socket proves transport establishment, not application health.