TCP/IP Model and Protocol Suite

The TCP/IP model (Transmission Control Protocol/Internet Protocol) is a conceptual framework that describes how data travels from one device to another over a network. It was developed by the U.S. Department of Defense in the 1970s and is documented in RFC 1122 and RFC 1123. Unlike the OSI model (which has seven layers), the TCP/IP model has four layers: Application, Transport, Internet, and Network Interface. The exam expects you to know the function of each layer, the protocols that operate at each layer, and how data encapsulation works.

Before standardized networking models, each vendor had proprietary protocols that could not interoperate. The TCP/IP model provided a common language so that devices from different manufacturers could communicate. It also introduced the concept of layering: each layer handles a specific aspect of communication, and changes in one layer do not affect others. This modularity allows protocols to be developed independently.

#### 1. Network Interface Layer (also called Link Layer)

This is the lowest layer, responsible for physical transmission of data over the medium (e.g., Ethernet, Wi-Fi, fiber). It includes hardware addresses (MAC addresses) and framing. The protocol data unit (PDU) at this layer is a frame. The Network Interface layer handles error detection using Frame Check Sequence (FCS) but does not guarantee delivery. Common protocols: Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), PPP, and ARP (Address Resolution Protocol) which maps IP addresses to MAC addresses.

#### 2. Internet Layer (also called Network Layer)

The Internet layer handles logical addressing (IP addresses) and routing. Its primary protocol is IP (Internet Protocol), which is connectionless and best-effort. The PDU at this layer is a packet. IP provides no error recovery or flow control—those are left to upper layers. IPv4 uses 32-bit addresses; IPv6 uses 128-bit addresses. Other protocols at this layer include: - ICMP (Internet Control Message Protocol): Used for error reporting (e.g., destination unreachable) and diagnostic tools like ping and traceroute. - ARP (Address Resolution Protocol): Although sometimes considered part of the Network Interface layer, ARP operates at the Internet layer to resolve IP addresses to MAC addresses. - IGMP (Internet Group Management Protocol): Used for multicast group management.

#### 3. Transport Layer

The Transport layer provides end-to-end communication between applications. It segments data from the Application layer and adds port numbers to identify the specific application. The two main protocols are: - TCP (Transmission Control Protocol): Connection-oriented, reliable, with flow control and error recovery. TCP uses a three-way handshake to establish a connection. It numbers segments and retransmits lost data. The PDU is called a segment. Default port numbers for common services: HTTP (80), HTTPS (443), FTP (21), SSH (22), SMTP (25). - UDP (User Datagram Protocol): Connectionless, unreliable, no handshake. It is used for real-time applications where speed matters more than reliability (e.g., DNS, DHCP, VoIP, streaming video). The PDU is called a datagram. Common ports: DNS (53), DHCP (67/68), TFTP (69), SNMP (161/162).

#### 4. Application Layer

The Application layer represents the user-facing protocols that provide network services. Unlike the OSI model, TCP/IP combines the Session, Presentation, and Application layers into one. Examples of Application layer protocols: - HTTP/HTTPS: Web browsing - FTP/SFTP: File transfer - SMTP/POP3/IMAP: Email - DNS: Domain name resolution - DHCP: Dynamic IP address assignment - SNMP: Network management - Telnet/SSH: Remote access

When an application sends data, it travels down the layers, each adding its own header (and sometimes trailer) in a process called encapsulation. The reverse process (removing headers) is decapsulation at the receiving end. - Application layer: Data (e.g., HTTP request) - Transport layer: Adds TCP or UDP header (segment/datagram) - Internet layer: Adds IP header (packet) - Network Interface layer: Adds frame header and trailer (frame)

The data is then transmitted as bits on the medium. The receiving device reverses this: it removes the frame header/trailer, then the IP header, then the TCP/UDP header, and finally delivers the data to the application.

The exam often compares TCP/IP and OSI models. Key points:

You must memorize the following port numbers for the exam:

- TCP ports: - 20/21: FTP (data/control) - 22: SSH - 23: Telnet - 25: SMTP - 53: DNS (also UDP) - 80: HTTP - 110: POP3 - 143: IMAP - 443: HTTPS - 3389: RDP - UDP ports: - 53: DNS - 67/68: DHCP - 69: TFTP - 161/162: SNMP - 520: RIP

TCP connections are established with a three-way handshake: 1. Client sends a SYN segment (sequence number = x). 2. Server responds with SYN-ACK (acknowledgment number = x+1, own sequence number = y). 3. Client sends ACK (acknowledgment number = y+1).

After this, data can be sent. The connection is closed with a four-way handshake (FIN). The exam may test the states of TCP connections (SYN_SENT, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, etc.).

UDP is stateless. There is no handshake; the sender just sends datagrams. This makes UDP faster but unreliable. Applications using UDP must handle reliability themselves if needed. Common UDP applications: DNS queries (usually), DHCP, VoIP (RTP), video streaming.

IPv4 addresses are 32 bits, written in dotted decimal (e.g., 192.168.1.1). They are divided into classes (A, B, C, D, E) but modern networking uses CIDR (Classless Inter-Domain Routing) for subnetting. IPv6 addresses are 128 bits, written in hexadecimal (e.g., 2001:db8::1). The exam expects you to know the difference between IPv4 and IPv6, including address exhaustion issues and the use of NAT with IPv4.

Network engineers use the following commands to verify TCP/IP operation:

TCP/IP works with many other technologies you will study: - NAT (Network Address Translation): Modifies IP addresses in packets, typically at the Internet layer. - VLANs: Operate at the Network Interface layer (Ethernet). - Routing protocols (OSPF, BGP): Operate at the Internet layer. - Firewalls: Inspect packets at various layers; stateful firewalls track TCP connections. - VPNs: Encapsulate IP packets in other protocols (e.g., IPsec, SSL/TLS).

When you visit a website: 1. Application layer: Browser sends HTTP GET request. 2. Transport layer: TCP adds a header with source port (random high port) and destination port 80. 3. Internet layer: IP adds a header with source and destination IP addresses. 4. Network Interface layer: Ethernet adds a header with source and destination MAC addresses and a trailer with FCS.

The frame is transmitted over the network. The web server reverses the process and sends back an HTTP response.

In a typical enterprise network, the TCP/IP model is the foundation for all communication. Consider a company with 1,000 employees accessing cloud-based applications. The network engineer configures DHCP servers to assign IP addresses dynamically, DNS servers to resolve internal and external hostnames, and firewalls to filter traffic based on IP addresses and ports. For example, a web server hosting the company's intranet listens on TCP port 443 (HTTPS). The engineer must ensure that the firewall allows inbound traffic to that port from the internal network only. Load balancers distribute incoming TCP connections across multiple web servers, using source IP persistence to maintain session affinity. When a user sends an email via SMTP (port 25), the email server relays it to the internet using MX records from DNS. The network team monitors performance using SNMP (UDP ports 161/162) and analyzes traffic with netstat and packet captures. A common issue is TCP window scaling: if a firewall or router is misconfigured to drop TCP options, performance degrades. Another scenario is VoIP deployment: phones use UDP for RTP (real-time transport) and require QoS to prioritize voice traffic. Misconfigured VLANs or MTU mismatches can cause one-way audio. The engineer must verify end-to-end connectivity with ping, traceroute, and path MTU discovery. In cloud environments, virtual networks implement TCP/IP with overlay protocols like VXLAN, which encapsulates Ethernet frames in UDP datagrams. Troubleshooting often involves checking TCP three-way handshake completion using packet captures—if SYN-ACK is not received, the issue could be a firewall blocking return traffic or a routing problem. The exam expects you to apply these concepts in scenario-based questions, such as identifying which layer a problem occurs at based on symptoms.