Chapter 3 — The four layers of TCP/IP

In one sentence

Link → Internet → Transport → Application: four layers, each with a job, each with its own protocols and its own name for a chunk of data.

The four layers

+----------------------------------------------------------------------+
| 4. APPLICATION    "What does this data MEAN?"                        |
|                                                                       |
|    HTTP (web), DNS (names), TLS (encryption), SMTP (email),          |
|    SSH (remote login), DHCP (auto-config)                            |
|    Unit of data: a MESSAGE                                            |
+----------------------------------------------------------------------+
| 3. TRANSPORT      "Which PROGRAM, and did it all arrive?"            |
|                                                                       |
|    TCP  - reliable, ordered, connection-based                        |
|    UDP  - fast, unreliable, no connection                            |
|    Unit of data: a SEGMENT (TCP) or DATAGRAM (UDP)                   |
+----------------------------------------------------------------------+
| 2. INTERNET       "Which MACHINE, anywhere in the world?"            |
|                                                                       |
|    IP (IPv4 and IPv6), ICMP (ping/errors)                            |
|    Unit of data: a PACKET                                             |
+----------------------------------------------------------------------+
| 1. LINK           "Which device on THIS cable/radio?"                |
|                                                                       |
|    Ethernet, Wi-Fi (802.11), ARP, and the physical wires/radio       |
|    Unit of data: a FRAME                                              |
+----------------------------------------------------------------------+

What each layer promises the one above it

This framing is worth memorising — troubleshooting is usually finding out which layer broke its promise.

Layer	Its promise
Link	"I'll deliver this frame to another device on this same physical network, or drop it. No promises about order or success."
Internet	"I'll make a best effort to get this packet to that IP address anywhere on Earth. It might be lost, duplicated, reordered, or delayed. Good luck."
Transport (UDP)	"Same as IP, but I'll tell you which program it's for and check it wasn't corrupted."
Transport (TCP)	"You get a reliable, ordered stream of bytes. They arrive exactly once, in order — or the connection breaks and I tell you."
Application	"I know what these bytes mean: a web page, a DNS answer, an email."

Notice that IP promises almost nothing. All the reliability you experience is built on top by TCP. That's deliberate — it keeps the middle of the network simple and fast (see "the end-to-end principle" below).

The OSI model (for exams)

You'll meet the 7-layer OSI model in certifications. Here's how it maps:

OSI #	OSI name	TCP/IP layer	What lives there really
7	Application	Application	HTTP requests, DNS queries
6	Presentation	Application	TLS encryption, compression, character encoding
5	Session	Application	TLS session reuse, RPC sessions
4	Transport	Transport	TCP, UDP
3	Network	Internet	IP
2	Data Link	Link	Ethernet/Wi-Fi framing, MAC addresses
1	Physical	Link	Copper, fibre, radio waves, voltages

People say "Layer 3" for IP and "Layer 7" for HTTP because product names use it:

L2 switch — forwards by MAC address (Chapter 7)
L3 switch / router — forwards by IP address (Chapter 13)
L4 load balancer — picks a server using IP + port, never reads the content
L7 load balancer / proxy — reads the HTTP request and routes by URL
"Layer 8 problem" — an old joke meaning "the user"

Simplified: the mapping above is approximate. TLS doesn't fit neatly into OSI layer 6, and nobody in practice cares. Use the 4-layer model to think, and the 7-layer names to communicate.

The two big design ideas

1. Packet switching. The phone network used to build a dedicated circuit for each call, reserved end to end. TCP/IP instead chops data into independently addressed packets that share links. A 1 Gbit/s link can serve thousands of mostly-idle connections, because they rarely all burst at once. Much more efficient — at the cost of variability.

2. The end-to-end principle. Keep the middle of the network dumb and fast; put the intelligence at the endpoints. A router in the middle just forwards packets toward their destination — it does not track your connection, retransmit for you, or care what's inside. This is why you can invent a whole new transport protocol (like QUIC, Chapter 30) without upgrading a single router on the internet.

The hourglass. Draw the protocol family and it looks like this:

  HTTP   DNS   SMTP   SSH   video   games   ...     <- many applications
      \     \    |     |    /      /
                TCP        UDP                      <- a few transports
                  \        /
                     IP                             <- ONE narrow waist
                   /    \
   Ethernet   Wi-Fi   4G/5G   fibre   cable   ...   <- many physical links

Everything runs over IP, and IP runs over everything. Agreeing on exactly one internetworking protocol in the middle is what lets any app work over any medium.

Practice (10 min)

Identify the layer for each of these, then check against Appendix F:

Your laptop's Wi-Fi card
192.168.1.50
Your browser asking for /index.html
Port 443
a4:83:e7:2b:19:0c
Retransmitting a lost chunk of a file
example.com
A router deciding which cable to send a packet down

Then run this and label which layer each piece of output belongs to:

ip -br addr        # or on macOS: ifconfig
ip route           # or on macOS: netstat -rn
ss -tan | head     # or on macOS: netstat -an | head
curl -sI https://example.com | head -3

Common confusions

"Frame vs packet vs segment — do they matter?" They're the same bytes at different layers, and using the right word makes conversations much clearer. Frame = link, packet = internet, segment = TCP. "Packet" is also used loosely as a catch-all; that's fine in conversation.
"Which layer is a firewall?" Depends on the firewall. Simple ones work at L3/L4 (IPs and ports). Modern ones also inspect L7 (HTTP content). Chapter 38.
"Why is IP so unreliable? Fix it!" It's a feature. Making IP reliable would make routers stateful, slow, and expensive, and would penalise apps (like video calls) that would rather drop a packet than wait for it.

Check yourself

Name the four layers, bottom to top, and one protocol at each.
What does IP not promise?
What is the end-to-end principle, and what does it buy us?
Why is the diagram called an hourglass?