Table of Contents

TCP/IP Explained: Model, 4 Layers, Protocols & Examples

TCP/IP Explained: A Complete Guide to the TCP/IP Model, Layers, and Protocols

Introduction

The internet does not work simply because computers connect to each other.

Behind every website request, API call, video stream, software update, SSH session, and cloud application is a collection of networking protocols that determine how information is addressed, transported, routed, delivered, and interpreted.

At the center of modern network communication is TCP/IP.

TCP/IP is not a single protocol. It is a suite of protocols that work together to enable communication across local networks and the global internet.

Understanding TCP/IP provides the foundation needed to understand IP addressing, routing, Ethernet, TCP, UDP, DNS, DHCP, network ports, NAT, firewalls, VPNs, cloud networking, and network troubleshooting.

For example, when you open https://corginetwork.com/ in a web browser, several networking operations take place.

A simplified web request using HTTPS over TCP may involve:

WEB BROWSER
     |
     v
DNS RESOLUTION
     |
     v
DESTINATION IP ADDRESS
     |
     v
ROUTING DECISION
     |
     v
TCP CONNECTION
     |
     v
TLS SECURITY
     |
     v
HTTP REQUEST
     |
     v
WEB SERVER

Modern browsers may also use HTTP/3 over QUIC, which follows a different transport arrangement. We will explain that distinction later.

Although these operations involve several technologies, TCP/IP provides the foundational architecture for communication between interconnected networks.

This guide explains the TCP/IP model, its layers and protocols, packet encapsulation, TCP and UDP communication, IPv4 and IPv6 addressing, routing, NAT, ports, DNS, network security, and practical troubleshooting.

If you are new to networking, our Computer Networking Explained guide provides additional background.

What Is TCP/IP?

TCP/IP stands for Transmission Control Protocol / Internet Protocol.

The term refers to the internet protocol suite: a family of protocols used to communicate across interconnected networks.

Two of its most important protocols are:

TCP (Transmission Control Protocol): Provides a reliable, ordered byte-stream transport service.
IP (Internet Protocol): Provides logical addressing and packet delivery across networks.

However, TCP and IP are only two members of a much larger protocol family.

Other important protocols and related networking technologies include:

Protocol	Primary Function
IP	Logical addressing and packet forwarding
TCP	Reliable, ordered byte-stream transport
UDP	Connectionless datagram transport
ICMP	Network control and diagnostic messages
DNS	Domain-name resolution
DHCP	Automatic network configuration
HTTP	Web communication
HTTPS	HTTP communication protected by TLS or an equivalent secure transport arrangement
SSH	Secure remote administration
ARP	IPv4 address-to-link-layer address resolution
Ethernet	Local wired network communication
Wi-Fi	Wireless local network communication

The power of TCP/IP comes from each protocol performing a specific task while cooperating with other protocols.

A web application does not need to know how an Ethernet interface transmits electrical signals. Likewise, an Ethernet switch does not need to interpret the contents of an HTTP request to forward an ordinary Ethernet frame.

This separation is a fundamental feature of layered networking architecture.

The IETF’s RFC 1122 provides foundational requirements for internet hosts and describes the layered internet architecture.

Why Was TCP/IP Created?

Early computer networks often used different and incompatible communication systems.

Devices could communicate within their own network environments but could not necessarily exchange data across unrelated networks.

The development of TCP/IP introduced common rules that allowed different networks to communicate.

This is particularly important because the internet is not one enormous physical network.

It is a network of networks.

For example:

NETWORK A
    |
    v
 ROUTER A
    |
    v
NETWORK B
    |
    v
 ROUTER B
    |
    v
NETWORK C

The underlying networks may use different physical technologies.

One connection might use Ethernet, another fiber-optic infrastructure, and another a wireless link.

IP provides a common addressing and forwarding framework across these environments.

This interoperability is one reason TCP/IP became the foundation of the modern internet.

Understanding the TCP/IP Protocol Suite

A common beginner mistake is to interpret TCP/IP as only TCP plus IP.

In reality, the internet protocol suite includes multiple protocols operating at different layers.

A simplified structure looks like this:

APPLICATION LAYER
    |
    +-- HTTP / HTTPS
    +-- DNS
    +-- SSH
    +-- SMTP
    |
TRANSPORT LAYER
    |
    +-- TCP
    +-- UDP
    |
INTERNET LAYER
    |
    +-- IPv4
    +-- IPv6
    +-- ICMP
    |
NETWORK ACCESS LAYER
    |
    +-- Ethernet
    +-- Wi-Fi
    +-- Link Technologies

Each layer provides services to the layer above it.

For example, HTTP can rely on a transport protocol to carry application messages, while the transport system uses IP for packet delivery.

IP then relies on an appropriate link-layer technology to transmit packets across the next local network segment.

The Four Layers of the TCP/IP Model

The TCP/IP model is commonly represented using four layers.

Layer	Name	Primary Responsibility	Examples
4	Application	Application communication	HTTP, DNS, SSH
3	Transport	End-to-end transport services	TCP, UDP
2	Internet	Logical addressing and routing	IPv4, IPv6, ICMP
1	Network Access	Local network delivery	Ethernet, Wi-Fi

Some educational materials use different terminology or divide network access into separate data-link and physical layers.

The important concept is the relationship between the layers.

Layer 4: Application Layer

The Application layer contains protocols and communication mechanisms used by network applications.

Examples include:

HTTP and HTTPS
DNS
SSH
SMTP
FTP

When a browser requests a webpage, it uses HTTP semantics.

An SSH client uses SSH to communicate securely with a remote system.

A DNS resolver uses DNS to retrieve information about domain names.

The application layer defines how these systems exchange and interpret their messages.

Layer 3: Transport Layer

The Transport layer provides communication services between application endpoints.

Two major transport protocols are TCP and UDP.

TCP provides an ordered, reliable byte stream.

UDP provides datagram communication without TCP’s built-in delivery and ordering mechanisms.

Transport protocols commonly use port numbers to identify application endpoints.

For example, one server may offer SSH on TCP port 22, HTTP on TCP port 80, and HTTPS on TCP port 443.

Not every modern transport technology fits neatly into this simplified model. QUIC, for example, implements substantial transport functionality over UDP.

Layer 2: Internet Layer

The Internet layer is responsible for logical addressing and packet forwarding across interconnected networks.

Its primary protocols include IPv4 and IPv6.

A packet may contain:

Source IP:      192.168.1.20
Destination IP: 203.0.113.50

Routers use destination addresses and routing information to decide where packets should be forwarded.

The Internet layer enables communication beyond the local network.

Layer 1: Network Access Layer

The Network Access layer handles communication over the underlying local network technology.

Examples include Ethernet and Wi-Fi.

This layer is associated with:

Ethernet frames
MAC addresses
Local network delivery
Wireless frames
Physical transmission technologies

When an IP packet must travel across an Ethernet network, it is typically carried inside an Ethernet frame.

When the packet reaches a router, the link-layer frame can be replaced for the next network segment.

This allows IP to operate across networks using different local transmission technologies.

TCP/IP Model vs OSI Model

Networking professionals frequently discuss both TCP/IP and the OSI model.

They are related but not identical.

The OSI reference model has seven layers:

7  Application
6  Presentation
5  Session
4  Transport
3  Network
2  Data Link
1  Physical

The commonly taught TCP/IP model has four layers:

4  Application
3  Transport
2  Internet
1  Network Access

A conceptual comparison is:

OSI Layer	TCP/IP Layer
Application	Application
Presentation	Application
Session	Application
Transport	Transport
Network	Internet
Data Link	Network Access
Physical	Network Access

This mapping is approximate rather than a perfect one-to-one equivalence.

The OSI model is particularly useful for explaining network functions and troubleshooting problems at different levels.

TCP/IP more directly describes the protocol architecture used throughout the internet.

For example, an Ethernet connectivity problem may involve lower-layer communication, while an HTTP error may occur at the application layer.

Understanding both models helps network administrators identify where problems originate.

What Is Encapsulation in TCP/IP?

Encapsulation is the process of adding protocol-specific information as data moves through networking layers.

When an application sends data, lower layers add information required to transport that data.

Consider a web request using TCP.

APPLICATION DATA
       |
       v
TCP SEGMENT
       |
       v
IP PACKET
       |
       v
ETHERNET FRAME
       |
       v
NETWORK TRANSMISSION

Each layer adds its own header.

A simplified Ethernet transmission may contain:

+--------------------------------------+
| Ethernet Header                      |
|  +--------------------------------+  |
|  | IP Header                      |  |
|  |  +--------------------------+  |  |
|  |  | TCP Header               |  |  |
|  |  |  +--------------------+  |  |  |
|  |  |  | Application Data   |  |  |  |
|  |  |  +--------------------+  |  |  |
|  |  +--------------------------+  |  |
|  +--------------------------------+  |
+--------------------------------------+

The receiving system processes the relevant headers and delivers the data through the appropriate layers.

This reverse process is called decapsulation.

Protocol Data Units

Different networking layers use different names for their data units.

Layer	Common Data Unit
Application	Data or application message
Transport using TCP	Segment
Transport using UDP	Datagram
Internet	IP packet
Network Access	Frame
Physical transmission	Bits or symbols

These terms are useful when reading packet captures and troubleshooting traffic.

How TCP Works

TCP (Transmission Control Protocol) provides a reliable, ordered byte-stream service between endpoints.

TCP is commonly used by applications that require data to arrive in the correct order without exposing ordinary packet loss directly to the application.

Important TCP mechanisms include:

Connection establishment
Sequence numbers
Acknowledgments
Retransmission
Flow control
Congestion control
Ordered byte-stream delivery
Connection termination

TCP does not guarantee that a remote application successfully processes a request.

Instead, it provides transport mechanisms that help applications exchange data reliably while a functioning TCP connection is maintained.

The current consolidated TCP specification is RFC 9293, published by the IETF in August 2022.

The TCP Three-Way Handshake Explained

Before normal data transfer over a new TCP connection, the endpoints usually perform a three-way handshake.

This process establishes important connection state and synchronizes sequence numbers.

CLIENT                         SERVER
   |                              |
   |----------- SYN ------------->|
   |                              |
   |<-------- SYN + ACK ----------|
   |                              |
   |----------- ACK ------------->|
   |                              |
   |       CONNECTION READY       |

Step 1: SYN

The client sends a TCP segment with the SYN flag set.

This begins the connection-establishment process and provides initial sequence information.

Step 2: SYN-ACK

The server responds with a segment containing SYN and ACK.

The server acknowledges the client’s SYN and communicates its own sequence information.

Step 3: ACK

The client sends an acknowledgment.

Once the handshake completes successfully, the connection is established and application data can be transferred.

Understanding these messages is important for analyzing firewall behavior, connection failures, and TCP packet captures.

TCP Sequence Numbers and Ordered Delivery

IP packets may travel through networks with different delays and paths.

As a result, TCP segments can arrive out of order.

TCP uses sequence numbers to identify positions in the transmitted byte stream.

For example, suppose a sender transmits three segments carrying 500 bytes each:

Segment A: Sequence 1000, 500 bytes
Segment B: Sequence 1500, 500 bytes
Segment C: Sequence 2000, 500 bytes

If Segment C arrives before Segment B, TCP can identify the missing part of the byte stream.

The receiver can retain suitable out-of-order data while waiting for the missing bytes, subject to implementation and available buffering.

The receiving application is normally presented with the ordered byte stream rather than arbitrary out-of-order network segments.

This behavior is central to TCP’s reliability model.

TCP Acknowledgments and Retransmission

TCP uses acknowledgments to communicate which data has been received.

A simplified exchange is:

SENDER                     RECEIVER
   |                           |
   |-------- DATA ------------>|
   |                           |
   |<-------- ACK -------------|
   |                           |

If transmitted data is lost, TCP can retransmit the missing information.

Loss recovery uses acknowledgments, timers, and other transport mechanisms.

TCP’s reliability comes from the coordinated use of sequence numbers, acknowledgments, retransmission, and connection state.

However, persistent network failures can still cause a TCP connection to time out or terminate.

TCP Flow Control vs Congestion Control

Flow control and congestion control solve different problems.

TCP Flow Control

Flow control prevents a sender from transmitting more data than the receiver can handle under the relevant receive-window constraints.

The receiver communicates available buffering information.

This helps prevent the receiving endpoint from being overwhelmed.

TCP Congestion Control

Congestion control addresses the condition of the network itself.

When too much traffic enters a network path, routers and links can become congested.

TCP uses congestion-control algorithms to adjust sending behavior in response to network conditions.

Different implementations may use different algorithms, but their shared objective is to balance efficient transmission with congestion management.

Flow Control vs Congestion Control

Mechanism	Main Concern
Flow Control	Receiver capacity
Congestion Control	Network congestion

Both mechanisms are important for TCP performance.

TCP Connection Termination

TCP connections can be closed in an orderly manner.

A common simplified close sequence is:

CLIENT                         SERVER
   |                              |
   |----------- FIN ------------->|
   |<---------- ACK --------------|
   |                              |
   |<---------- FIN --------------|
   |----------- ACK ------------->|

Each direction of a TCP connection can be closed independently.

The exact behavior depends on the connection state, application actions, and whether the connection closes normally or is reset.

Understanding TCP termination helps administrators interpret socket states and packet captures.

What Is UDP?

UDP stands for User Datagram Protocol.

UDP provides a connectionless datagram transport service.

Unlike TCP, UDP does not provide built-in guarantees for reliable delivery, ordering, or retransmission.

Its header is relatively small, and it does not require a TCP-style connection-establishment handshake.

UDP is useful for applications that want to control their own delivery behavior or prefer lightweight datagram communication.

Examples include traditional DNS requests, DHCP communication, certain real-time applications, and QUIC-based transport.

The UDP protocol is specified in RFC 768.

TCP vs UDP: Key Differences

Feature	TCP	UDP
Communication model	Connection-oriented	Connectionless
Reliable byte-stream delivery	Yes	No built-in guarantee
Ordering	Ordered byte stream	No built-in ordering
Retransmission	Built in	Application or higher protocol must provide it
Flow control	Built in	Not built in
Congestion control	Built in	Not built into UDP itself
Header size	Larger	Smaller
Examples	SSH, HTTP/1.1, HTTP/2	DNS, DHCP, QUIC

Neither protocol is universally faster or better.

The correct choice depends on application requirements.

For example, QUIC uses UDP as its substrate but implements advanced reliability, congestion control, and stream management itself.

Therefore, choosing UDP does not automatically mean an application operates without reliability mechanisms.

Understanding IP: IPv4 and IPv6

The Internet Protocol (IP) provides logical addressing and packet delivery across interconnected networks.

Two major IP versions are in widespread use.

IPv4

IPv4 uses 32-bit addresses.

Example:

192.168.1.25

IPv4 addresses are commonly written as four decimal numbers separated by periods.

Private IPv4 address ranges are frequently used inside homes and organizations.

Examples include:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

These private addresses are not normally routed across the public internet.

IPv6

IPv6 uses 128-bit addresses.

Example:

2001:db8:1234::25

IPv6 provides a much larger address space and introduces important architectural differences from IPv4.

Its features include expanded addressing, a simplified base header, different neighbor-discovery mechanisms, and support for several address-configuration methods.

IPv6 is specified in RFC 8200.

IPv4 vs IPv6

Feature	IPv4	IPv6
Address length	32 bits	128 bits
Notation	Dotted decimal	Colon-separated hexadecimal
Example	192.168.1.25	2001:db8::25
Broadcast	Supported	No IPv4-style broadcast
Neighbor discovery	ARP for common Ethernet IPv4 use	IPv6 Neighbor Discovery
Address configuration	Static, DHCPv4 and other mechanisms	SLAAC, DHCPv6, static configuration

IPv6 is not simply IPv4 with longer addresses.

It includes different protocol behaviors that administrators must understand.

IPv4 Packet Structure and TTL

An IPv4 packet contains a header and payload.

Important IPv4 header fields include:

Source IP address
Destination IP address
Version
Header length
Total length
Time To Live (TTL)
Protocol identifier
Fragmentation-related information

The destination address is especially important for packet forwarding.

What Is TTL?

TTL stands for Time To Live.

Although the name suggests time, IPv4 TTL functions primarily as a hop-limit mechanism.

Each router forwarding an IPv4 packet decrements the TTL.

If forwarding would reduce the value to zero, the router discards the packet.

This helps prevent packets from circulating indefinitely because of routing loops.

Traceroute tools use related packet-expiration and response behavior to discover intermediate network devices.

IPv6 uses a corresponding field called Hop Limit.

What Is Routing in TCP/IP?

Routing is the process of determining where IP packets should be forwarded.

Routers maintain routing information and use destination addresses to select forwarding paths.

Consider a simplified IPv4 routing table:

Destination        Next Hop
192.168.1.0/24     Directly Connected
10.0.0.0/8         192.168.1.1
0.0.0.0/0          Default Gateway

The router examines the destination IP address and looks for an applicable route.

Routing may involve directly connected networks, static routes, and routes learned through routing protocols.

For an overview of the infrastructure used to forward packets, read Routers, Switches and Network Devices.

Longest Prefix Match

Routers commonly select the most specific matching route.

Suppose the routing table contains:

10.0.0.0/8
10.10.0.0/16
10.10.20.0/24

A packet destined for 10.10.20.50 matches all three prefixes.

The most specific match is:

10.10.20.0/24

This is called longest prefix matching.

It is essential for understanding routing decisions, subnet design, and many connectivity problems.

What Is ARP?

ARP stands for Address Resolution Protocol.

In common IPv4 Ethernet networks, ARP helps determine the link-layer address associated with a local IPv4 destination or next hop.

Suppose a computer wants to communicate with 192.168.1.10 on its local network.

It may send an ARP request:

Who has 192.168.1.10?

The device using that address may respond:

192.168.1.10 is at AA:BB:CC:DD:EE:FF

The requesting host can then use the MAC address when constructing an Ethernet frame.

ARP results may be stored temporarily in an ARP cache.

For destinations outside the local subnet, the host ordinarily resolves the MAC address of the relevant next-hop gateway rather than the remote internet server.

IPv6 uses Neighbor Discovery instead of ARP.

How an IP Packet Travels Across the Internet

Consider a laptop accessing a web server hosted on another network.

A simplified forwarding path might look like:

LAPTOP
   |
   v
WI-FI ACCESS POINT
   |
   v
HOME ROUTER
   |
   v
ISP NETWORK
   |
   v
INTERNET ROUTERS
   |
   v
DESTINATION NETWORK
   |
   v
WEB SERVER

The packet may cross multiple routers and networks.

Each router uses its forwarding information to determine the next hop.

The router does not need the entire path to be encoded inside every ordinary IP packet.

Instead, intermediate devices make forwarding decisions using their routing tables and network policies.

The return path may not always be identical to the outgoing path.

This is another reason packet-level troubleshooting requires knowledge of routing and network topology.

What Is NAT?

NAT stands for Network Address Translation.

NAT changes IP addressing information as packets pass through a translating device.

It is commonly used in IPv4 networks to allow devices using private addresses to communicate with external services.

For example:

HOME NETWORK
  |
  +-- Laptop: 192.168.1.10
  +-- Phone:  192.168.1.11
  +-- TV:     192.168.1.12
  |
  v
HOME ROUTER / NAT
  |
  v
PUBLIC INTERNET

A common form is Network Address and Port Translation, often called PAT or NAPT.

This allows many internal connections to share one public IPv4 address while being distinguished using translated port information.

NAT vs Firewall

NAT and firewall filtering are not the same thing.

NAT changes address or port information.

A firewall enforces rules determining whether traffic may pass.

They frequently operate on the same router or appliance, but their functions are distinct.

Our Firewalls Explained guide examines firewall policy and traffic inspection in greater detail.

TCP/IP Ports Explained

Transport-layer ports help identify communication endpoints for applications.

A server may host multiple services using one IP address.

For example:

192.0.2.10:22
192.0.2.10:80
192.0.2.10:443

The IP address is the same, but the ports identify different transport endpoints.

Common port assignments include:

Port	Common Service
TCP 22	SSH
TCP 25	SMTP
TCP/UDP 53	DNS
TCP 80	HTTP
TCP 443	HTTPS using TCP-based HTTP versions
UDP 443	Common HTTP/3 over QUIC deployment
UDP 67/68	DHCPv4 server/client
TCP 110	POP3
TCP 143	IMAP

Port numbers are conventions and assignments, not proof of which application is actually running.

Administrators may configure services to use nonstandard ports.

Likewise, security policies should not assume that a connection is safe merely because it uses TCP port 443.

What Is a Network Socket?

A socket is an operating-system abstraction representing an endpoint used for network communication.

For many practical TCP troubleshooting tasks, a connection can be identified by:

Source IP address
Source port
Destination IP address
Destination port
Transport protocol

For example:

Client:   192.168.1.20:51542
Server:   203.0.113.50:443
Protocol: TCP

This combination helps distinguish simultaneous connections.

A workstation can maintain several connections to the same server, and the operating system can distinguish them through their associated endpoint information.

TCP/IP and DNS

DNS operates at the application layer and relies on underlying networking protocols for communication.

DNS allows applications to resolve domain names and retrieve other DNS information.

For example:

APPLICATION
     |
     v
DNS RESOLVER
     |
     v
DNS RESPONSE
     |
     v
DESTINATION IP ADDRESS

A browser may resolve a domain name before establishing a connection to the selected server address.

DNS can use UDP and TCP, depending on the message and operating requirements.

Modern deployments may also use encrypted DNS transports such as DNS over HTTPS (DoH) or DNS over TLS (DoT).

DNS is important, but it should not be confused with IP routing.

DNS helps applications discover addressing information.

IP provides packet delivery across networks.

For a detailed explanation, see DNS Explained.

TCP/IP and DHCP

DHCP automates IP configuration for many network devices.

A DHCP server may provide:

IPv4 address
Subnet mask
Default gateway
DNS resolver addresses
Lease duration

This allows a client to obtain the configuration needed to communicate on its network without requiring every setting to be entered manually.

For example, a workstation may receive:

IP Address:      192.168.10.50
Subnet Mask:     255.255.255.0
Default Gateway: 192.168.10.1
DNS Server:      192.168.10.10

DHCP and DNS perform different tasks, but they frequently work together.

Our DHCP Explained article covers the DORA process, DHCP scopes, leases, relay agents, and troubleshooting.

TCP/IP, HTTPS, HTTP/2, and HTTP/3

HTTPS is HTTP communication protected by a secure transport arrangement.

For traditional HTTPS using HTTP/1.1 or HTTP/2 over TCP, a simplified stack is:

HTTP/1.1 OR HTTP/2
         |
         v
        TLS
         |
         v
        TCP
         |
         v
         IP
         |
         v
   ETHERNET / WI-FI

TLS provides confidentiality, integrity protection, and server authentication when implemented and validated correctly.

However, modern web communication also includes HTTP/3.

How HTTP/3 Changes the Transport Stack

HTTP/3 uses QUIC rather than TCP.

QUIC commonly operates over UDP and incorporates TLS 1.3 security mechanisms.

A simplified HTTP/3 stack looks like:

       HTTP/3
          |
          v
    QUIC + TLS 1.3
          |
          v
         UDP
          |
          v
          IP
          |
          v
    ETHERNET / WI-FI

QUIC provides transport features including reliable streams, flow control, congestion control, and connection establishment mechanisms.

This illustrates an important point:

Modern web traffic does not always use TCP, even when the website uses HTTPS.

HTTP/3 is specified in RFC 9114.

For network troubleshooting, this distinction matters because a firewall allowing TCP 443 does not necessarily permit UDP 443.

Applications may fall back to TCP-based HTTP when QUIC connectivity is unavailable, depending on their implementation and configuration.

Practical TCP/IP Commands on Windows

Windows includes built-in utilities for examining IP configuration, routing, DNS, and network connectivity.

Display IP Configuration

ipconfig

For more detailed configuration:

ipconfig /all

This can display IP addresses, subnet masks, gateways, DNS servers, and DHCP information.

Test Basic Connectivity

ping 8.8.8.8

A successful response may indicate that the destination is reachable using ICMP.

However, failed ICMP requests do not necessarily mean that TCP or HTTPS communication will fail.

Test DNS Resolution

nslookup example.com

Trace a Network Route

tracert example.com

The command attempts to identify intermediate network hops.

Some routers may not respond to the relevant probe traffic.

Display Routing Information

route print

Inspect ARP Information

arp -a

Test a TCP Service

Test-NetConnection example.com -Port 443

This is more directly relevant to HTTPS TCP connectivity than relying on ping alone.

Practical TCP/IP Commands on Linux

Linux provides several powerful networking utilities.

Display IP Addresses

ip addr

Display Routing Information

ip route

Inspect Neighbor Information

ip neigh

Test ICMP Connectivity

ping 8.8.8.8

Query DNS

dig example.com

Trace a Network Path

traceroute example.com

The command may require installation depending on the distribution.

Inspect Listening Sockets

ss -tuln

Test HTTPS

curl -I https://example.com

This requests HTTP response headers and can help verify application-layer behavior.

Inspect the Path to a Destination

ip route get 8.8.8.8

This can help identify the route and source address the system would select.

For a larger collection of practical tools, see our Linux Network Tools Guide.

A Practical TCP/IP Troubleshooting Method

Suppose a Linux server cannot access a website.

Instead of assuming that DNS or the application is broken, investigate the network stack systematically.

Step 1: Check Network Interfaces

ip addr

Verify that the relevant interface is operational and has an appropriate IP address.

Step 2: Check Routing

ip route

Determine whether the host has a route to the destination and an appropriate default route.

Step 3: Test the Local Gateway

ping 192.168.1.1

Replace the example address with the actual gateway.

If the gateway does not respond, inspect local connectivity, ARP or neighbor discovery, interface state, and relevant security policies.

Remember that a gateway may intentionally block ICMP.

Step 4: Test a Remote IP Address

ping 8.8.8.8

This can provide evidence about IP connectivity when ICMP is permitted.

Step 5: Test DNS

dig example.com

If IP connectivity works but name resolution fails, DNS configuration becomes a likely area of investigation.

Step 6: Test the Application

curl -I https://example.com

A web service can fail even when routing and DNS function correctly.

Potential application-level causes include TLS configuration, server errors, authentication failures, and unavailable application dependencies.

The objective is to identify which layer is failing before changing configuration.

Example: Diagnosing a Website That Appears Down

Imagine a user reports:

The website is not working.

That statement describes a symptom, not its cause.

Possible causes include DNS failure, incorrect routing, blocked traffic, failed TCP or QUIC connectivity, TLS errors, web server problems, or application failure.

A structured investigation might look like:

CHECK DNS
    |
    +-- Fails -> Investigate Resolver
    |
    v
CHECK NETWORK ROUTE
    |
    +-- Fails -> Investigate Gateway/Routing
    |
    v
CHECK TRANSPORT CONNECTIVITY
    |
    +-- Fails -> Investigate Firewall/Endpoint
    |
    v
CHECK TLS
    |
    +-- Fails -> Investigate Security Negotiation
    |
    v
CHECK HTTP RESPONSE
    |
    +-- Fails -> Investigate Application
    |
    v
SERVICE IS RESPONDING

This approach helps administrators avoid unnecessary changes.

For example, restarting a web server will not repair an incorrect DNS record.

Similarly, changing DNS settings will not fix a firewall rule that blocks required traffic.

Packet Capture and TCP/IP Analysis

When standard troubleshooting commands are insufficient, packet capture can provide detailed evidence.

Tools such as Wireshark and tcpdump can help administrators inspect traffic on systems they own or are authorized to analyze.

A packet capture may show:

Ethernet frames
IPv4 and IPv6 packets
TCP connection establishment
DNS requests and responses
ICMP messages
TCP retransmissions
QUIC packets
Available TLS handshake information

For example, a TCP connection may include:

SYN
SYN, ACK
ACK
APPLICATION DATA
ACK
FIN, ACK
ACK

The exact packet sequence depends on the application and connection behavior.

Useful Wireshark Display Filters

For TCP traffic:

tcp

For UDP traffic:

udp

For DNS traffic:

dns

For ICMP:

icmp

For QUIC:

quic

Packet captures should be handled carefully because they may contain sensitive addressing information, credentials in unencrypted protocols, or other private data.

TCP/IP Security Considerations

TCP/IP provides networking capabilities, but ordinary IP communication does not automatically provide complete confidentiality, authentication, or authorization.

Security must be implemented through additional controls.

Firewalls

Firewalls restrict unauthorized network communication according to configured policies.

For an in-depth guide, see Firewalls Explained.

Encryption

TLS, SSH, IPsec, and other appropriate cryptographic mechanisms can protect communications.

Authentication

Users and systems should authenticate before receiving access to sensitive resources.

Network Segmentation

Segmentation helps separate environments with different security requirements.

Monitoring

Logs and network telemetry help administrators detect unusual behavior and investigate incidents.

Updates and Hardening

Operating systems, networking devices, applications, and firmware should receive appropriate security maintenance.

Least Privilege

Network services and user accounts should receive only the access they require.

These controls form part of the broader principles explained in our Network Security Basics and Cybersecurity for Beginners guides.

Common TCP/IP Misconceptions

TCP Is Always Faster Than UDP

Not necessarily.

TCP and UDP provide different transport services.

Performance depends on application behavior, network conditions, protocol implementation, and other factors.

An IP Address Always Identifies One Computer

An IP address identifies an address assignment associated with a network interface or networking context.

A device can have multiple IP addresses, and several devices may appear to external systems through one translated public IPv4 address.

DNS Is the Internet

DNS is an important naming system, but it is only one component of internet communication.

Ping Proves Whether a Website Works

Ping tests ICMP behavior.

A web server may block ICMP while continuing to provide HTTPS service.

Port 443 Always Means HTTPS

TCP or UDP port 443 is commonly associated with secure web traffic, but port numbers alone do not prove which application is running.

HTTPS Always Runs Over TCP

Not anymore.

HTTP/1.1 and HTTP/2 commonly use TCP-based HTTPS connections.

HTTP/3 uses QUIC over UDP.

TCP Guarantees That an Application Will Succeed

TCP can provide reliable byte-stream transport while the connection operates correctly.

It cannot guarantee that a database saves a transaction, a web server completes a request, or an application processes the received data correctly.

A Complete TCP/IP Web Request Example

Now combine the networking concepts into one realistic scenario.

You enter:

https://corginetwork.com/

into your browser.

Stage 1: Application Request

The browser identifies the requested website and begins determining how to connect to it.

Stage 2: DNS Resolution

The system resolves the domain name using the relevant DNS mechanisms.

A cached answer may already be available.

Stage 3: Address Selection and Routing

The operating system selects an appropriate destination address and determines the network route.

Stage 4: Local Network Delivery

If the destination is remote, the device sends traffic toward the next-hop gateway.

On an Ethernet or Wi-Fi network, this involves suitable link-layer addressing.

Stage 5: NAT, If Applicable

A home router may translate the private source IPv4 address into a public address.

Stage 6: Internet Routing

Routers forward the packets across interconnected networks toward the destination.

Stage 7: Transport Connection

For HTTP/1.1 or HTTP/2, the browser typically establishes a TCP connection.

For HTTP/3, it uses QUIC over UDP when supported and selected.

Stage 8: Secure Communication

TLS or QUIC’s integrated TLS security mechanisms protect the relevant communication.

Stage 9: HTTP Request

The browser sends the HTTP request using the negotiated HTTP version.

Stage 10: Server Response

The server processes the request and returns a response.

The browser receives the content and renders the page.

Additional resources such as images, stylesheets, and scripts may require further network requests.

What appears to the user as one simple action actually involves multiple protocols working together.

TCP/IP Learning Roadmap

To build practical networking skills, study TCP/IP progressively.

Level 1: Networking Fundamentals

Begin with:

IP addresses
MAC addresses
Ethernet
Wi-Fi
Routers and switches
DNS
DHCP

Level 2: Transport Protocols

Study:

TCP
UDP
Ports and sockets
TCP connection states
Handshakes
Retransmissions
Flow control
Congestion control

Level 3: IP Addressing and Routing

Learn:

IPv4 and IPv6
Subnet masks
CIDR
Routing tables
Default routes
Static routing
Longest prefix match

Level 4: Application Protocols

Explore:

HTTP/HTTPS
DNS
SSH
SMTP
DHCP
TLS
QUIC and HTTP/3

Level 5: Network Security

Study:

Firewalls
VPNs
Network segmentation
Access control
IDS/IPS
Zero Trust fundamentals

For related subjects, continue with VPNs Explained and Network Security Basics.

Level 6: Advanced Networking

Progress toward:

OSPF
BGP
VLANs
VXLAN
SD-WAN
Load balancing
Anycast
Cloud networking
Network automation

This approach builds a connected understanding of networking instead of relying on memorized definitions.

Key Takeaways

The most important concepts from this guide are:

TCP/IP is a protocol suite, not a single protocol.
The TCP/IP model is commonly represented using four layers: Application, Transport, Internet, and Network Access.
IP provides logical addressing and packet forwarding.
TCP provides reliable, ordered byte-stream transport.
UDP provides connectionless datagram transport.
Encapsulation allows the networking layers to cooperate.
Routers use destination addresses and routing information to forward packets.
Ports distinguish transport communication endpoints.
DNS provides naming information used by applications.
DHCP automates important IP configuration tasks.
NAT translates addressing information.
HTTP/3 uses QUIC over UDP rather than TCP.
Layered troubleshooting helps isolate the actual cause of network failures.
TCP/IP security requires additional protection through encryption, access control, firewalls, and monitoring.

Frequently Asked Questions

What Does TCP/IP Stand For?

TCP/IP stands for Transmission Control Protocol / Internet Protocol.

The term commonly refers to the broader internet protocol suite rather than only those two protocols.

What Are the Four Layers of TCP/IP?

The commonly taught four-layer model consists of Application, Transport, Internet, and Network Access.

What Is the Difference Between TCP and IP?

IP provides logical addressing and packet delivery across networks.

TCP provides reliable, ordered byte-stream transport between application endpoints.

Is TCP/IP the Same as the OSI Model?

No.

The OSI model has seven conceptual layers, while the commonly taught TCP/IP model has four.

What Is the TCP Three-Way Handshake?

It is the process normally used to establish a TCP connection through SYN, SYN-ACK, and ACK messages.

What Is a TCP Segment?

A TCP segment is a transport-layer unit containing TCP control information and, when present, application data.

What Is an IP Packet?

An IP packet consists of an IP header and payload used to transport information across IP networks.

Why Is UDP Used If It Does Not Guarantee Delivery?

UDP is useful when applications prefer lightweight datagram communication or implement their own transport behavior.

QUIC is an important example of a modern protocol that provides advanced transport functionality over UDP.

What Is Encapsulation?

Encapsulation is the process of adding protocol-specific information as data moves through networking layers before transmission.

Does HTTPS Always Use TCP?

No.

HTTP/1.1 and HTTP/2 commonly use TCP for HTTPS, while HTTP/3 uses QUIC over UDP.

What Is the Difference Between a Port and an IP Address?

An IP address identifies an addressing endpoint in an IP networking context.

A transport port helps distinguish application communication endpoints using protocols such as TCP or UDP.

Why Is TCP/IP Important for Cybersecurity?

Understanding TCP/IP helps security professionals analyze traffic, configure firewalls, investigate suspicious connections, design network segmentation, and troubleshoot security incidents.

Why Should Beginners Learn TCP/IP?

TCP/IP is foundational to networking, cybersecurity, system administration, cloud computing, DevOps, and web infrastructure.

Understanding how its protocols interact makes advanced networking topics easier to learn.

Conclusion

TCP/IP is one of the fundamental technologies behind the modern internet.

What appears to users as a simple action—opening a webpage, connecting to a server, sending a message, or accessing an application—actually involves multiple networking protocols working together.

Applications generate data and interpret responses.

Transport protocols provide communication services between endpoints.

IP provides addressing and packet forwarding.

Ethernet and Wi-Fi carry traffic across local networks.

Routers connect different networks.

DNS helps applications locate services.

TLS and other security mechanisms protect communication.

Firewalls and access controls restrict unauthorized access.

Each technology performs a specific function, but together they form the communication infrastructure on which modern computing depends.

Understanding TCP/IP makes it easier to study subnetting, routing, VLANs, VPNs, cloud networking, network security, packet analysis, and troubleshooting.

The objective is not simply to memorize protocols or commands.

The real goal is to understand how information moves from one application to another across interconnected networks.

That understanding is the foundation of professional networking.

To continue learning, explore Computer Networking Explained, DNS Explained, DHCP Explained, Routers, Switches and Network Devices, and Network Security Basics.